Search: “c-plus-plus”

26 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75863) in Adobe Photoshop DCM file parsing.

The Zero Day Initiative published advisory ZDI-26-678 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75863 with a CVSS 7.8 score. The flaw occurs while parsing DCM files. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 3 sources CVE-2026-75863

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added CVE-2026-76461, an actively exploited SQL injection in Cisco Secure Email Gateway, to the KEV catalog.

CISA added CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets and to check whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

CISA Advisoriesupdated 13:57 UTC · 5h agofirst Sep 14, 12:00 UTC · 2d agoExploit / PoC in the wild 17 sources CVE-2026-76461

ZDI-26-658: Adobe Acrobat Pro DC JPEG Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI discloses CVE-2026-81987, an integer overflow in Adobe Acrobat Pro DC JPEG parsing enabling remote code execution with CVSS 7.8.

The Zero Day Initiative published ZDI-26-658 covering an integer overflow in Adobe Acrobat Pro DC's parsing of JPEG files. Successful exploitation allows arbitrary code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI assigned a CVSS score of 7.8 and tracked the flaw as CVE-2026-81987.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 19 sources CVE-2026-81987

GNU security advisory (AV26-923)

Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.

The Canadian Centre for Cyber Security issued advisory AV26-923 on September 15, 2026, covering CVE-2026-91752, a stack overflow vulnerability in GNU libextractor versions prior to 1.15 triggered via OLE2 file parsing. The Cyber Centre encourages users and administrators to review the provided links and apply necessary updates as they become available.

Canadian Centre for Cyber SecuritySep 15, 15:10 UTC · 1d agoAdvisory CVE-2026-91752

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-78012

[webapps] C-MOR 6.0104 - Directory Traversal

A directory traversal proof-of-concept for video surveillance software C-MOR version 6.0104 has been published on Exploit-DB.

Exploit-DB entry 52666 discloses a directory traversal vulnerability in C-MOR version 6.0104, a video surveillance platform. The issue is listed under web application vulnerabilities. No CVE identifier or exploitation evidence is included in the listing.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC

Fortinet security advisory (AV26-023) - Update 1

CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.

The Canadian Centre for Cyber Security updated advisory AV26-023, which relays January 2026 Fortinet advisories covering FortiFone, FortiOS, FortiSASE, FortiSIEM, and FortiSwitchManager. On September 9, 2026, CISA added CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its Known Exploited Vulnerabilities catalog. Related Fortinet flaws include unauthenticated local configuration access (CVE-2025-47855) and unauthenticated remote command injection (CVE-2025-64155). Administrators should review the advisories and apply available updates.

Canadian Centre for Cyber Securityupdated Sep 10, 11:26 UTC · 6d agofirst Sep 9, 19:57 UTC · 6d agoExploit / PoC in the wild 3 sources CVE-2025-25249 CVE-2025-47855 CVE-2025-64155

[Control Systems] National Instruments security advisory (AV26-856)

Canada's Cyber Centre relayed National Instruments advisories for memory corruption, out-of-bounds read, and out-of-bounds write flaws in LabVIEW versions.

The Canadian Centre for Cyber Security published control systems advisory AV26-856 covering National Instruments LabVIEW. Affected versions include releases before 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1. The flaws include memory corruption, an integer conversion out-of-bounds read, and an integer overflow out-of-bounds write. Users and administrators are urged to review the links and apply NI security updates.

Canadian Centre for Cyber SecurityAug 28, 12:16 UTC · 19d agoAdvisory

N-able N-central HF4 Fixes Critical RCE After Series of Authentication Flaws

N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a critical pre-authentication RCE.

N-able shipped N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to patch CVE-2026-86218, a critical remote code execution vulnerability exploitable without authentication. The hotfix follows a series of authentication flaws discovered in the N-central platform. Organizations running N-central should apply the update promptly; the notice does not report active exploitation.

SOCRadarSep 7, 07:51 UTC · 9d agoVulnerability CVE-2026-86218

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.

The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-202151

ZDI-26-630: NI LabVIEW VI File Parsing Integer Overflow Information Disclosure Vulnerability

ZDI disclosed CVE-2026-18445, an integer overflow in NI LabVIEW VI file parsing that can disclose sensitive information, rated CVSS 3.3.

The Zero Day Initiative published advisory ZDI-26-630 describing an integer overflow vulnerability in NI LabVIEW's parsing of VI files. Exploitation can disclose sensitive information and requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI assigned the flaw a CVSS rating of 3.3.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory 2 sources CVE-2026-18445

Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.

Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.

Canadian Centre for Cyber SecuritySep 8, 19:03 UTC · 8d agoAdvisory in the wildCVE-2026-81963 CVE-2026-858801

[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090

Vim sign_jump() before v9.2.1090 permits Ex command injection via unescaped buffer names; low-severity patch disclosed by Christian Brabandt.

Christian Brabandt disclosed an Ex command injection vulnerability in Vim's sign_jump() function affecting versions before v9.2.1090, caused by improper neutralization of unescaped buffer names. The issue is rated Low severity and maps to CWE-88 (argument injection) and CWE-94 (code injection). A CVE has been requested but not yet assigned.

oss-securitySep 12, 17:53 UTC · 4d agoVulnerability

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-securitySep 4, 21:23 UTC · 11d agoVulnerability

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-87020

[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)

A proof-of-concept cross-site scripting exploit for C-MOR video surveillance software 6.0104 appeared on Exploit-DB.

Exploit-DB published a proof-of-concept cross-site scripting (XSS) exploit against C-MOR 6.0104, an IP video surveillance platform. The listing demonstrates script injection in the web interface, but the provided text contains no CVE identifier or indication of active exploitation. Successful XSS against the surveillance console could enable session hijacking or manipulation of the monitoring interface.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC1

ZDI-26-545: Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

ZDI discloses CVE-2026-69256, a CVSS 8.8 code injection in Flowise CSV_Agent customReadCSV allowing authenticated remote attackers to execute arbitrary code.

ZDI advisory ZDI-26-545 describes a code injection vulnerability in Flowise's CSV_Agent customReadCSV functionality, tracked as CVE-2026-69256 with a CVSS score of 8.8. It allows remote attackers to execute arbitrary code on affected Flowise installations. Authentication is required to exploit the vulnerability.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-69256

ZDI-26-565: Gen Digital CCleaner Link Following Local Privilege Escalation Vulnerability

A link-following flaw (CVE-2026-12410, CVSS 7.8) in Gen Digital CCleaner allows local privilege escalation after low-privileged code execution.

ZDI advisory ZDI-26-565 details a link following vulnerability in Gen Digital CCleaner that permits local privilege escalation. An attacker must first be able to run low-privileged code on the affected installation. ZDI rated the issue 7.8 on CVSS and assigned CVE-2026-12410.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-12410

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own out-of-bounds write RCE (CVSS 7.5) in Amazon Smart Plug's OTA process, exploitable by unauthenticated network-adjacent attackers.

The Zero Day Initiative published ZDI-26-559 for an out-of-bounds write remote code execution flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.5.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-634: Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability

ZDI disclosed a CVSS 9.8 unauthenticated prompt injection vulnerability in Flowise's CSV agent that allows remote arbitrary code execution.

ZDI published advisory ZDI-26-634 for a prompt injection vulnerability in Flowise's CSV agent component. Remote, unauthenticated attackers can inject prompts to execute arbitrary code on affected installations. ZDI assigned CVSS 9.8 and the issue is tracked as CVE-2026-70477.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory CVE-2026-70477

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19781

Citrix security advisory (AV26-833) - Update 1

CISA added actively exploited NetScaler flaw CVE-2026-19490 to its KEV catalog; the Canadian Cyber Centre urges Citrix ADC and Gateway admins to patch.

The Canadian Centre for Cyber Security updated advisory AV26-833 covering Citrix NetScaler ADC and Gateway vulnerabilities in versions 13.1 (prior to 13.1-63.21) and 14.1 (prior to 14.1-73.32), plus FIPS builds. On September 9, 2026, CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog, indicating confirmed exploitation. The bulletin also references CVE-2026-19489 from the Citrix NetScaler ADC and Gateway Security Bulletin. Administrators should apply the fixed builds, including 13.1-37.277 and 14.1-73.32 for FIPS variants.

Canadian Centre for Cyber Securityupdated Sep 10, 18:57 UTC · 6d agofirst Sep 9, 20:10 UTC · 6d agoExploit / PoC in the wild 5 sources CVE-2026-19489 CVE-2026-19490

Cisco security advisory (AV26-197) – Update 3

CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.

The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.

Canadian Centre for Cyber Securityupdated Sep 14, 09:27 UTC · 2d agofirst Sep 9, 20:04 UTC · 6d agoExploit / PoC in the wild 11 sources CVE-2026-20131 CVE-2026-20079

ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability

ZDI discloses an unauthenticated code injection remote code execution flaw in Flowise's Airtable_Agent (CVE-2026-69264, CVSS 9.8).

ZDI advisory ZDI-26-546 describes a code injection vulnerability in the Flowise Airtable_Agent that allows remote attackers to execute arbitrary code. No authentication is required to exploit the flaw, which carries a CVSS rating of 9.8 and is assigned CVE-2026-69264. Flowise deployments exposing the vulnerable agent component are at risk of full server takeover.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-69264

CISA Warns of N-able N-central RCE Vulnerability Exploited in the Wild

CISA added CVE-2026-86218, a CVSS 10.0 unauthenticated RCE in N-able N-central RMM, to its KEV catalog; on-premises admins must patch to 2026.3.1.14.

CISA added CVE-2026-86218, a CVSS 10.0 static code injection (CWE-96) enabling unauthenticated RCE in N-able N-central, to the Known Exploited Vulnerabilities catalog on September 8, 2026. The flaw affects all on-premises builds before 2026.3.1.14 across the 2025.4 through 2026.3 release lines; N-able shipped Hotfix 4 for 2026.3 on September 5-6, 2026. Huntress research indicates at least one customer's N-central instance was compromised on September 4, and federal civilian agencies must mitigate by September 11 under BOD 26-04. Hosted environments were patched server-side, but a compromised RMM server can serve as a single point of entry into entire MSP client bases.

Cyber Security NewsSep 9, 13:31 UTC · 7d agoExploit / PoC in the wildCVE-2026-86218 CVE-2026-86206 CVE-2026-862071

USN-8737-1: GNU C Library vulnerabilities

Ubuntu patches GNU C Library flaws including a strfmon buffer overflow and tdelete out-of-bounds access that could enable code execution.

Ubuntu issued USN-8737-1 fixing multiple GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in the strfmon function when handling right-justification padding, affecting only Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in the tdelete function. An additional issue involves incorrect memory handling in wordexp with the WRDE_APPEND flag. All issues could potentially cause denial of service or arbitrary code execution.

Ubuntu Security NoticesSep 8, 15:17 UTC · 8d agoAdvisory CVE-2026-19499 CVE-2026-19542