ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: CERT/CC Vulnerability Notes

13 stories

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 13
SeverityAllcritical 0high 3medium 8low 2info 0source: CERT/CC Vulnerability Notes ✕

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.

CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.

CERT/CC Vulnerability Notes · 4d agoVulnerabilityCVE-2026-842861

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.

CERT/CC issued VU#687587 for CVE-2026-12780, an incorrect permission assignment (CWE-732) in the amwrtdrv.sys kernel driver shipped with AOMEI Backupper 8.4.0. The driver exposes a world-accessible device object without a security descriptor, allowing any unprivileged user to write arbitrary physical disk sectors; with Secure Boot disabled, an attacker can modify the GPT and inject a UEFI payload that executes before the OS loads, bypassing HVCI, EDR, Windows Defender and Hyper-V isolation. On TPM-only BitLocker configurations the attack can capture Volume Master Key material during pre-boot. AOMEI has shipped patches; users who cannot update should uninstall the software or disable the amwrtdrv.sys service, and enabling Secure Boot adds defense in depth.

CERT/CC Vulnerability Notes · 5d agoVulnerabilityCVE-2026-127801

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability Notes · 7d agoVulnerabilityCVE-2026-20293CVE-2026-33197CVE-2026-6485

VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.

CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.

CERT/CC Vulnerability Notes · 7d agoVulnerabilityCVE-2025-20701

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.

CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.

CERT/CC Vulnerability Notes · 7d agoVulnerabilityCVE-2026-84282

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.

CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.

CERT/CC Vulnerability Notes · 12d agoVulnerabilityCVE-2026-15630

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

CVE-2026-80047: Hugging Face Transformers 4.49.0 through 5.8.1 writes attacker-controlled Python files to disk before the trust_remote_code consent check.

CERT/CC vulnerability note VU#456290 describes CVE-2026-80047 in the Hugging Face Transformers library, affecting versions 4.49.0 through 5.8.1. The library performs a remote module fetch and writes attacker-controlled Python files to the local disk before evaluating the trust_remote_code consent prompt, without user authorization. This violates the security contract enforced across other dynamic module-loading paths in the library. Transformers is a primary framework for training and inference across NLP, vision, audio, video, and multimodal machine learning systems.

CERT/CC Vulnerability Notes · 14d agoVulnerabilityCVE-2026-80047

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes · 21d agoVulnerability

VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow

CERT/CC details CVE-2026-19874, a heap overflow in Metal Gear Online 3 letting match hosts execute code on lobby members' machines.

VU#728712 describes a heap-based buffer overflow in Konami's Metal Gear Online 3, tracked as CVE-2026-19874, affecting version 1.1.2.8 (Steam AppID 287700). The input-validation flaw lies in processing Steam lobby metadata tied to the player-removal feature, letting a match host trigger remote code execution on lobby members' machines via specially crafted data. The game is an 8v8 competitive shooter using Steam Matchmaking for lobbies.

CERT/CC Vulnerability Notes · 22d agoVulnerabilityCVE-2026-19874

VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

CERT/CC warns Calix GS7 XGS GS5239XG routers on firmware EXOS/6.6.47 expose an unauthenticated UPnP WANIPConnection service on the public WAN interface.

CERT/CC issued VU#756733 for a missing authentication vulnerability in the Calix GS7 XGS GS5239XG residential gateway running EXOS/6.6.47. The device's UPnP service, implemented with MiniUPnPd 2.3.7, is exposed on the WAN interface by default and does not require authentication, potentially letting remote attackers alter port mappings through the WANIPConnection service. The flaw affects routing, NAT, and firewall functionality for home networks.

CERT/CC Vulnerability Notes · 25d agoVulnerability

VU#874418: RDK-B WebUI contains multiple vulnerabilities

CERT/CC warns RDK-B WebUI rdkb-2025q4-kirkstone contains multiple flaws enabling network attackers to bypass authentication, cause DoS, or potentially execute code.

VU#874418 describes multiple vulnerabilities in the RDK-B WebUI version rdkb-2025q4-kirkstone, the open-source Reference Design Kit for Broadband used in broadband gateways and networking devices. Issues include memory corruption, improper authentication, race conditions, and insufficient input validation. A network-adjacent attacker could bypass authentication, obtain administrative access, cause denial-of-service, or corrupt underlying processes, with potential arbitrary code execution under certain conditions.

CERT/CC Vulnerability Notes · 27d agoVulnerability

VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

CERT/CC discloses two TPM 2.0 reference code flaws allowing RSA key decryption and forged TPM attestations via crafted commands.

CERT/CC published VU#431093 covering two vulnerabilities in the TCG TPM 2.0 reference implementation: CVE-2026-6726 (information leakage via falsified TPM keys) and CVE-2026-6727 (timing side-channel in RSA OAEP decryption). An attacker with privileged access to a TPM command interface could send crafted TPM commands to decrypt ciphertexts for affected TPM-managed RSA keys, including the RSA Endorsement Key, or obtain credentials enabling forged TPM 2.0 attestations. Remediation is tracked in TCGVRT010 and TCGVRT0011.

CERT/CC Vulnerability Notes · Aug 11, 2026VulnerabilityCVE-2026-6726CVE-2026-6727

VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability

OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.

CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.

CERT/CC Vulnerability Notes · Aug 10, 2026VulnerabilityCVE-2026-184121