ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “code execution”

21 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 6207Malware 3862Exploit / PoC 3182Ransomware 1949Threat actor 883Data breach 637Policy & legal 338Phishing & fraud 309Advisory 222Industry 219AI safety & security 181Research 81AI tools & infra 75AI research 50
SeverityAllcritical 8863high 5386medium 3219low 499info 361

ZDI-26-585: OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI reported an out-of-bounds write in OriginLab Origin Viewer's OGWU parsing (CVE-2026-19885) that allows remote code execution via crafted files.

ZDI-26-585 details an out-of-bounds write vulnerability when OriginLab Origin Viewer parses OGWU files, leading to remote code execution. A successful attack requires the user to open a malicious file or visit a malicious page. The flaw carries a CVSS rating of 7.8 and is tracked as CVE-2026-19885. No in-the-wild exploitation is mentioned.

ZDI Published Advisories · 23d agoVulnerabilityCVE-2026-19885

ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability

The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.

ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.

ZDI Published Advisories · 23d agoVulnerability

ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.

ZDI-26-701 covers an out-of-bounds read information disclosure vulnerability in the Linux Kernel TLS protocol implementation, tracked as CVE-2026-64046 with a CVSS rating of 6.7. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-640461

ZDI-26-699: Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerability

ZDI-26-699: Linux Kernel NTFS3 out-of-bounds read (CVSS 5.2) lets local low-privileged attackers disclose sensitive information.

ZDI advisory ZDI-26-699 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 5.2. An attacker must already have the ability to execute low-privileged code on the target system to trigger the flaw. Successful exploitation results in information disclosure. No CVE identifier is listed in the advisory.

ZDI Published Advisories · 2d agoVulnerability 3 sources

ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability

ZDI discloses an uninitialized-memory flaw in Linux kernel IPv6 neighbor discovery (CVE-2026-43040, CVSS 6.0) allowing information disclosure by already-privileged local attackers.

ZDI advisory ZDI-26-682 describes an uninitialized memory vulnerability in the Linux kernel's IPv6 Neighbour Discovery code, tracked as CVE-2026-43040 with a CVSS score of 6.0. Exploitation requires the attacker to already execute high-privileged code on the target, which severely limits practical impact to kernel memory information disclosure. No active exploitation is mentioned.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-430401

ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability

ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.

ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-45930

ZDI-26-640: Oracle VirtualBox VirtioSCSI Uninitialized Memory Information Disclosure Vulnerability

ZDI detailed an uninitialized memory flaw in Oracle VirtualBox's VirtioSCSI (CVE-2026-71132) allowing local attackers to disclose sensitive information.

Zero Day Initiative published ZDI-26-640, a CVSS 5.3 information disclosure vulnerability in the VirtioSCSI component of Oracle VirtualBox. An attacker must first run high-privileged code on the guest system before the uninitialized memory issue can be used to disclose sensitive information. The flaw is tracked as CVE-2026-71132. The advisory reports no exploitation activity.

ZDI Published Advisories · 7d agoVulnerability 6 sourcesCVE-2026-71132

ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-626 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bzfilelist component.

The Zero Day Initiative published advisory ZDI-26-626 describing a link-following denial-of-service vulnerability in the bzfilelist component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published Advisories · 7d agoVulnerability 5 sourcesCVE-2026-19820

ZDI-26-615: (0Day) pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Zero Day Initiative disclosed an uncontrolled search path flaw in pdfforge PDF Architect's update service, allowing local privilege escalation (CVSS 7.8).

ZDI published advisory ZDI-26-615 describing a local privilege escalation vulnerability in the activation-service Update Service of pdfforge PDF Architect. An uncontrolled search path element lets local attackers escalate privileges, but they must first be able to execute low-privileged code on the target. ZDI rated the issue 7.8 and tagged it as a 0-day disclosure.

ZDI Published Advisories · 16d agoVulnerability

ZDI-26-606: Microsoft Windows Compatibility Appraiser Link Following Local Privilege Escalation Vulnerability

ZDI disclosed a link-following flaw in Windows Compatibility Appraiser (CVSS 7.0) enabling local privilege escalation from the LOCAL SERVICE context.

ZDI-26-606 describes a link-following vulnerability in the Windows Compatibility Appraiser component that permits local privilege escalation. An attacker must already be able to execute low-privileged code in the LOCAL SERVICE context on the target system. ZDI rated the issue 7.0 on the CVSS scale; the advisory lists no CVE identifier. No active exploitation is reported.

ZDI Published Advisories · 23d agoVulnerability2

ZDI-26-576: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability

ZDI disclosed a race condition local privilege escalation flaw in the Linux Kernel XFRM subsystem, CVSS 7.5, with no CVE assigned.

The Zero Day Initiative published ZDI-26-576 describing a race condition in the Linux Kernel XFRM subsystem. Local attackers can escalate privileges, but the advisory states an attacker must first be able to execute high-privileged code on the target. ZDI assigned a CVSS score of 7.5; no CVE identifier is listed in the advisory text.

ZDI Published Advisories · Aug 13, 2026Vulnerability