ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “grants”

21 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 32Exploit / PoC 29Vulnerability 23Industry 21Phishing & fraud 19Research 18Threat actor 14Policy & legal 14AI industry 12Data breach 11Malware 10Tools 10Advisory 10AI policy 5
SeverityAllcritical 10high 64medium 54low 4info 109

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope CVE-2026-73470 lets delegated users grant roles they do not own via crafted delegations.

Apache Syncope disclosed CVE-2026-73470, an improper privilege management vulnerability rated important. Delegations can be created or updated so that delegated users are able to grant roles they do not own, breaking ownership constraints. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users are advised to upgrade to the latest fixed releases.

oss-security · 2d agoVulnerabilityCVE-2026-73470

Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.

Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 (September 16, 2026) describes CVE-2026-76460, insufficient authentication controls (CWE-648) on an exposed API endpoint in Cisco ISE and ISE-PIC, rated CVSS 10.0. Successful exploitation lets an unauthenticated remote attacker bypass management interface authentication and potentially obtain command-and-control with root privileges, enabling log tampering and persistence. Software updates are available with no workarounds; Cisco urges prioritized patching, log review for suspicious usernames, and reimaging of suspect nodes.

GBHackersupdated · 37m agofirst · 55m agoVulnerability in the wild 19 sourcesCVE-2026-76460

Multiple Vulnerabilities Discovered in a SCADA System

Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.

Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.

Palo Alto Unit 42 · 28d agoVulnerabilityCVE-2024-1182CVE-2024-7587CVE-2024-8299+2 CVEs1

Privileged File System Vulnerability Present in a SCADA System

Unit 42 details CVE-2025-0921 (CVSS 6.5), a privileged file operations flaw in Iconics Suite enabling DoS and privilege escalation.

Unit 42 disclosed CVE-2025-0921 (CVSS 6.5), an execution-with-unnecessary-privileges flaw in the Pager Agent of the AlarmWorX64 MMX feature of Mitsubishi Electric Iconics Digital Solutions GENESIS64. Attackers could misuse privileged file system operations to corrupt critical binaries, causing denial-of-service or integrity loss on vulnerable SCADA systems. The analysis demonstrates a chain with CVE-2024-7587, which grants excessive permissions to the C:\ProgramData\ICONICS directory via the GenBroker32 installer. Iconics released an advisory with a workaround that addresses the reported issues.

Palo Alto Unit 42 · 28d agoVulnerabilityCVE-2025-0921CVE-2024-7587

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · securityupdated · 1h agofirst · 12h agoVulnerability 4 sourcesHN 35↑ · 3 commentsCVE-2021-1905CVE-2018-9568

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.

VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.

The Hacker News · 8d agoVulnerability in the wildCVE-2026-74232CVE-2026-74233CVE-2026-66747

Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication

Check Point patched CVE-2026-91843 (CVSS 9.8), an unauthenticated stack overflow enabling remote root code execution on Security Management and Log Servers.

Check Point issued a high-severity alert for CVE-2026-91843, a critical stack overflow (CVSS 9.8, solution sk1000155) in the unauthenticated login workflow of Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. Successful exploitation grants an unauthenticated remote attacker root-level code execution. Affected releases span R80 through R82.20 with Jumbo Hotfix takes at or below specified levels (e.g., R82.20 Take 44, R81.20 Take 166), with several older versions end of support. A LivePatch is available and offline urgent bundles (R81.20-R82.20 Takes 28-29) were released; Smart-1 Cloud is already protected.

GBHackers · 5h agoVulnerability 9 sourcesCVE-2026-918431

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.

CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.

oss-security · 1d agoVulnerability 2 sourcesCVE-2026-76187

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.

The Hacker Newsupdated · 1d agofirst · 2d agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-54420

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00–16.29 allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service, which is exposed only when MESSENGER is enabled and a reCAPTCHA secret has been configured. Exploitation yields command execution under the unprivileged CSF service account, providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 or later fixes the issue; disabling MESSENGER in /etc/csf/csf.conf and restarting csf and lfd is a temporary mitigation.

GBHackers · 5d agoVulnerability 3 sourcesCVE-2026-65638

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker News · 7d agoVulnerability in the wildCVE-2026-59821CVE-2026-59822CVE-2026-42271+2 CVEs

FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs

Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.

The Fortinet FortiPAM Chrome extension flaw (CVE-2026-84388, CVSS 9.1) lets attacker-controlled domains be trusted as FortiPAM servers because a webRequest listener adds requested hostnames without verifying the initiator. A second issue exposes the extension's message interface to all URLs and accepts non-JWT tokens without validation, enabling unauthenticated session launches, proxy manipulation, tab control and recording; the consent dialog can also be bypassed via shadow-root clicks. Fortinet issued advisory FG-IR-26-168 after a July 17 report and released a fix on August 1, 2026, with no confirmed exploitation in the wild.

GBHackers · 7d agoVulnerabilityCVE-2026-843882

Ivanti Patches 10 EPMM, Neurons for ITSM and Sentry Flaws Enabling RCE and Admin Access

Ivanti patches 10 flaws in EPMM, Neurons for ITSM, and Sentry, including two 9.8-rated unauthenticated RCEs in ITSM.

Ivanti released fixes for 10 vulnerabilities across Endpoint Manager Mobile, Neurons for ITSM, and Sentry, and said it was not aware of active exploitation at disclosure. The most severe are CVE-2026-12744 and CVE-2026-12745, unauthenticated deserialization RCEs rated 9.8 in Neurons for ITSM, alongside authenticated deserialization and missing-authorization RCEs rated up to 9.9. CVE-2026-18851 is an 8.8-rated EPMM privilege escalation to administrator, and CVE-2026-83527 is an 8.1-rated unauthenticated authentication bypass in Sentry granting administrative access. Ivanti said the ITSM weaknesses were found using large language models; Cloud/SaaS fixes shipped August 9, 2026, and on-premises patches are available from September 2026.

GBHackers · 8d agoVulnerabilityCVE-2026-12744CVE-2026-12745CVE-2026-12651+7 CVEs1

FortiSandbox Vulnerability Allows Attackers to Access Sensitive Information via Crafted HTTP Requests

Fortinet disclosed CVE-2026-26084 (CVSS 8.9), an unauthenticated information-disclosure flaw in the FortiSandbox web UI, urging upgrades.

Fortinet patched CVE-2026-26084, a CWE-284 improper access control flaw in the shared web UI of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that lets unauthenticated attackers read sensitive data via crafted HTTP requests. Affected releases include FortiSandbox 5.0.0-5.0.5 and 4.4.0-4.4.8, Cloud 5.0.4-5.0.5, and PaaS 5.0.4-5.0.5; fixes arrive in 5.0.6+ and 4.4.9+, while FortiSandbox 5.2 and Cloud 4.4 are unaffected. The issue was found internally by Fortinet's Product Security team, and the company reports no evidence of exploitation in the wild. Disclosure carries only confidentiality impact, but exposed sandbox configurations and logs could aid follow-on attacks.

Cyber Security News · 8d agoVulnerabilityCVE-2026-26084

Patch Tuesday - September 2026

Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.

Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.

Rapid7 Blog · 8d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-85046+10 CVEs

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...

JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.

Web discovery (articles for new exploits & KEV entries) · 8d agoVulnerabilityCVE-2026-63077

Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks

Ivanti patched ten CVEs across EPMM, Neurons for ITSM and Sentry, including critical unauthenticated deserialization RCE; no active exploitation reported.

On September 8, 2026, Ivanti disclosed advisories covering ten CVEs in Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry. The most severe are two unauthenticated deserialization RCE flaws in Neurons for ITSM, CVE-2026-12744 and CVE-2026-12745 (CVSS 9.8), plus three missing-authorization RCE bugs rated 9.9 and three authenticated deserialization RCE flaws. EPMM has CVE-2026-18851 (CVSS 8.8), an authenticated privilege escalation flaw, and Sentry has CVE-2026-83527 (CVSS 8.1), an authentication bypass. Ivanti reports no evidence of active exploitation; cloud/SaaS ITSM was patched on August 9, 2026, while on-premises 2025.2 through 2026.1 require September 2026 patches.

Cyber Security News · 8d agoVulnerabilityCVE-2026-18851CVE-2026-12744CVE-2026-12745+7 CVEs

Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...

CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.

CVE-2026-60004 is a CWE-94 code injection flaw in Gitea's POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, disclosed July 28, 2026 with a CVSS v3.1 score of 9.8 and credited to researcher Shai Rod (NightRang3r). An add/add collision with the three-way merge fallback (--3, Git 2.32+) writes attacker-controlled content into the temporary bare clone's hooks directory, where it executes as a live Git hook running commands as the Gitea OS user. Exploitation requires repository write access, but Gitea's default open registration allows anonymous users to obtain it, exposing app.ini secrets, database credentials, OAuth tokens, and mounted repositories; a public PoC requires no outbound callback. All releases from 1.17 through 1.27.0 are affected; the fix shipped in Gitea 1.27.1 on July 27, 2026, and Gitea Cloud instances were upgraded automatically.

Web discovery (articles for new exploits & KEV entries) · 9d agoVulnerabilityCVE-2026-600041

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help

High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.

Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.

Zscaler ThreatLabz · 13d agoVulnerabilityCVE-2026-629112

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.

CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.

CERT/CC Vulnerability Notes · 13d agoVulnerabilityCVE-2026-15630

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

Critical type-confusion flaw in isolated-vm Node.js sandbox (GHSA-864f-rcv7-6rh4) enables guest-to-host escape and potential RCE; fixed in 6.2.0 and 7.0.1.

Endor Labs researcher Cristian-Alexandru Staicu found a type confusion in the ExternalCopy component's handling of the transferList option in isolated-vm, letting sandboxed JavaScript corrupt host-process memory and escalate from controlled-address crashes to full control-flow hijack of the host, i.e., potential remote code execution. The flaw, tracked as GHSA-864f-rcv7-6rh4 with no CVE yet, affects all versions through 7.0.0 of the library, which sees nearly 1 million npm downloads weekly. It was patched in versions 6.2.0 and 7.0.1 released earlier in August 2026, and full exploit details are withheld to prevent attacks. The V8 Isolate boundary itself held; the failure was in the C++ marshalling code bridging host and guest.

The Hacker News · 27d agoVulnerability1