Search: “cve-2016-0101”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 1 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.

Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.

Help Net SecurityAug 12, 00:00 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-68820 CVE-2026-62832 CVE-2026-72971+6 CVEs1

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited zero-days: CVE-2026-85880, an ALPC heap buffer overflow, and CVE-2026-81963 in the Windows Update Stack, both CVSS 7.8 local privilege escalations. It also addresses an unauthenticated Exchange RCE (CVE-2026-55007) triggered by Visio attachment content indexing under memory pressure, an RDP use-after-free (CVE-2026-69525, CVSS 9.8), and 20 wormable flaws in DNS, DHCP, SMB, Active Directory, and other components. ZDI attributed the rising volume partly to AI-assisted vulnerability discovery, noting no corresponding spike in active exploits yet.

Security AffairsSep 9, 07:03 UTC · 7d agoVulnerability in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-55007+3 CVEs2

Microsoft breaks Patch Tuesday record with 974-CVE deluge

Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.

Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.

The Register · SecuritySep 9, 00:25 UTC · 8d agoExploit / PoC in the wildCVE-2026-75650 CVE-2026-85880 CVE-2026-81963+3 CVEs1

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

A maximum-severity (CVSS 10.0) unauthenticated RCE flaw in SAP Commerce Cloud, CVE-2026-58231, is under active exploitation days after patching.

CVE-2026-58231, rated 10.0 on CVSS, stems from insufficient authorization checks and input validation in SAP Commerce Cloud, enabling unauthenticated arbitrary code execution. Defused Cyber's honeypots detected exploitation attempts three days after the patch, and KEVIntel independently confirmed two attempts on August 14 from a US IP address. Onapsis urges customers to patch and rebuild, with an IP Filter Set offered as a temporary workaround. No actor attribution yet, though prior SAP NetWeaver flaw CVE-2025-31324 was exploited by China-nexus and criminal groups.

The Hacker NewsAug 17, 17:57 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2026-58231 CVE-2025-31324

CVE-2026-0770: Langflow exec_globals RCE Vulnerability

CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow's exec_globals, endangering exposed deployments.

CVE-2026-0770 is a critical remote code execution vulnerability in Langflow, a popular open-source framework for building language model applications. It allows remote attackers to execute arbitrary code on affected installations without authentication, making internet-exposed deployments particularly dangerous. The flaw resides in the exec_globals component; the available disclosure does not state active exploitation or provide patch details.

Web discovery (articles for new exploits & KEV entries)Aug 24, 09:57 UTC · 23d agoVulnerability CVE-2026-0770

CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)

CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.

CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. CVE-2026-83548 is a critical (CVSS 10.0) pre-authentication SSRF in the SMA1000 Appliance Work Place interface; CVE-2026-83549 is a high (CVSS 7.8) post-authentication OS command injection leading to RCE in the Appliance Management Console. SMA1000 models 6210, 7210, and 8200v running 12.4.3-03453 or 12.5.0-02835 platform-hotfix and older are affected; fixes ship in 12.4.3-03526 and 12.5.0-02952. Qualys customers can detect vulnerable assets via QID 388624.

Qualys ThreatPROTECTSep 3, 13:09 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs details a pre-authentication remote code execution flaw, tracked as CVE-2026-8452, in Citrix NetScaler appliances.

watchTowr Labs published technical analysis of a pre-authentication remote code execution vulnerability in Citrix NetScaler, tentatively assigned CVE-2026-8452. The CVE identifier is marked as provisional in the write-up. No confirmation of in-the-wild exploitation is provided in the available text.

watchTowr LabsAug 14, 07:08 UTC · Aug 14, 2026Exploit / PoC CVE-2026-8452

Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.

Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).

SecurityWeekSep 8, 19:20 UTC · 8d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-55007+5 CVEs1

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.

CSO OnlineSep 9, 03:27 UTC · 8d agoVulnerability in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-69730+2 CVEs1

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable BlogSep 8, 18:07 UTC · 8d agoVulnerability in the wildCVE-2026-81963 CVE-2026-858801

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.

SonicWall disclosed on September 1, 2026 that CVE-2026-83548, a critical pre-authentication SSRF in the SMA1000 Appliance Work Place interface (CVSS 10.0), and CVE-2026-83549, an authenticated OS command injection in the Appliance Management Console, can be chained for unauthenticated remote code execution. Both vulnerabilities are confirmed exploited in the wild and were added to CISA's Known Exploited Vulnerabilities catalog. Affected SMA1000 models 6210, 7210 and 8200v on versions 12.4.3-03453 and 12.5.0-02835 platform-hotfix or earlier require upgrades to 12.4.3-03526 or 12.5.0-02952 platform-hotfixes.

Rapid7 BlogSep 2, 16:58 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

SAP Patches Critical Extended Passport Processing Vulnerability

SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.

CVE-2026-44756 is a CVSS 10.0 memory corruption flaw in Extended Passport (EPP) deserialization, triggered when a user session opens across web, SAP GUI, and RFC vectors. Exploitation yields command execution as the SAP OS account, database credential and password hash recovery, session reading, and data or binary modification; affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, and BW/4HANA. Three other criticals were patched: CVE-2026-58240 (S4GET, missing authentication affecting all S/4HANA 2025 and earlier releases), CVE-2026-76969 (CAP credential disclosure), and CVE-2026-66768 (NetWeaver access control). Onapsis and SAP report no indicators of in-the-wild exploitation.

SecurityWeekSep 8, 14:55 UTC · 8d agoVulnerability 2 sources CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+1 CVEs

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 and Microsoft disclose CVE-2026-63520, a SharePoint RCE that chains with CVE-2026-55040 for unauthenticated RCE; patches released.

Rapid7 Labs' zero-day research project on Microsoft SharePoint uncovered two vulnerabilities that, when chained, achieve unauthenticated remote code execution. The second flaw in the chain, CVE-2026-63520, affects all supported versions of Microsoft SharePoint and has been disclosed and fixed. The first chain component, CVE-2026-55040, was disclosed by Rapid7 and Microsoft the previous month.

Rapid7 BlogAug 11, 13:00 UTC · Aug 11, 2026Vulnerability CVE-2026-63520 CVE-2026-550401

Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code

Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.

Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.

Cyber Security NewsSep 9, 10:10 UTC · 7d agoVulnerability CVE-2026-69485

CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.

Web discovery (articles for new exploits & KEV entries)Sep 7, 19:42 UTC · 9d agoVulnerability 3 sources CVE-2026-505221

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)

Tenable reports Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including three zero-days, one exploited in the wild (CVE-2026-68820).

Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 important, and one moderate, and three zero-days among them. One zero-day is confirmed as exploited in the wild. The release covers components including .NET, .NET Framework, Active Directory Certificate Services (AD CS), Azure services, and Windows. Tenable's count omits two CVEs assigned by MITRE, CVE-2026-6726 and CVE-2026-6727.

Tenable BlogAug 11, 18:04 UTC · Aug 11, 2026Vulnerability in the wildCVE-2026-68820 CVE-2026-6726 CVE-2026-67271

Microsoft fixes record 964 flaws, including 2 exploited zero-days

Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.

Microsoft's September 2026 Patch Tuesday addresses 964 customer-patchable CVEs (104 Critical, 860 Important), the largest release on record, out of 974 total listed. Two actively exploited zero-days are fixed: CVE-2026-81963, a link-following elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape, both with CVSS 7.8. Both zero-days were exploited before a patch was available and grant SYSTEM-level access after an initial foothold. The release also includes high-severity RCE fixes for Windows DNS Server, Remote Desktop Services, Exchange Server, SharePoint, and SQL Server.

Malwarebytes LabsSep 9, 10:01 UTC · 7d agoExploit / PoC in the wildCVE-2026-81963 CVE-2026-858801

Microsoft Patch Tuesday for August 2026 Fixed a Zero

Microsoft's August 2026 Patch Tuesday fixes 398 CVEs, including an actively exploited WinSock zero-day CVE-2026-68820 and wormable DNS RCE CVE-2026-62878.

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, .NET and other products, with 62 rated Critical. The actively exploited CVE-2026-68820 is a use-after-free in the Windows WinSock afd.sys driver that can yield SYSTEM privileges via a race condition. CVE-2026-62878 is a critical, wormable stack buffer overflow in Windows DNS Server allowing unauthenticated, remote code execution without user interaction. Other notable fixes include WDS TFTP RCE CVE-2026-62893, a QUIC flaw affecting roughly 13.5 million sites (CVE-2026-62815), an Exchange authentication bypass EoP demonstrated at Pwn2Own Berlin (CVE-2026-62911), and two TPM 2.0 reference implementation fixes.

Security AffairsAug 12, 06:49 UTC · Aug 12, 2026Advisory in the wildCVE-2026-68820 CVE-2026-62878 CVE-2026-62893+5 CVEs

Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.

Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.

Infosecurity MagazineSep 9, 09:40 UTC · 7d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-62878+4 CVEs1

CVE-2026-52307: Stored XSS in 1CMS v5.6

CVE-2026-52307: authenticated stored XSS in 1CMS (ClassCMS) v5.6 Column Management lets attackers inject scripts via the title field.

ClassCMS 1CMS v5.6 contains an authenticated stored cross-site scripting vulnerability, CVE-2026-52307, in the Column Management component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field. No CVSS score, patch information, or exploitation evidence was provided in the disclosure.

Full DisclosureSep 8, 17:24 UTC · 8d agoVulnerability CVE-2026-52307

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) enables unauthenticated root command execution via crafted email; CISA added it to KEV.

CVE-2026-76461 is a critical SQL injection (CVSS 9.8) in Cisco AsyncOS for Secure Email Gateway allowing an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a specially crafted email through a vulnerable gateway. CISA added it to the KEV catalog on disclosure day, indicating zero-day exploitation, and Cisco PSIRT became aware of active exploitation in September 2026. No public PoC or attribution exists; fixed versions are 15.5.5-014, 16.0.4-302, and 16.5.0-780, and admins should check mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM'.

Rapid7 Blogupdated Sep 16, 13:57 UTC · 14h agofirst Sep 15, 12:22 UTC · 1d agoExploit / PoC in the wild 17 sources CVE-2026-76461

AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489

Canadian Cyber Centre alerts on Citrix NetScaler ADC/Gateway flaws CVE-2026-19490 (authentication bypass) and CVE-2026-19489 (buffer overflow), urging emergency patching.

The Canadian Centre for Cyber Security issued alert AL26-019 covering two Citrix NetScaler vulnerabilities disclosed in a vendor advisory on August 19, 2026. CVE-2026-19490 (CWE-288) allows a remote unauthenticated attacker to bypass authentication on appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. CVE-2026-19489 (CWE-120) is a classic buffer overflow that may cause memory overflow, unpredictable behavior, or denial-of-service conditions. Affected appliances are vulnerable when configured as a SAML IdP; fixed versions include 14.1-73.32, 13.1-63.21, and 13.1-37.277 for FIPS.

Canadian Centre for Cyber SecuritySep 4, 19:00 UTC · 12d agoAdvisory 3 sources CVE-2026-19490 CVE-2026-19489

ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 use-after-free remote code execution flaw (CVE-2026-81976) in Adobe Acrobat Reader DC triggered via malicious PDFs.

The Zero Day Initiative published advisory ZDI-26-675 describing a use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC, tracked as CVE-2026-81976 with a CVSS 7.8 score. The flaw resides in the annotation feature. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The advisory reports no evidence of in-the-wild exploitation.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 19 sources CVE-2026-819761

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.

Francesco Chicchiriccò posted a low-severity advisory for CVE-2026-77181, an Incorrect Authorization vulnerability in Apache Syncope's syncope-core-am-logic module. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. An administrator holding the ClientApp update entitlement finds it is not applied as expected. No exploitation is reported and the issue is rated low severity.

oss-securitySep 14, 15:45 UTC · 2d agoVulnerability CVE-2026-77181

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

CVE-2026-19490 is a critical unauthenticated authentication bypass in Citrix NetScaler ADC and Gateway, remotely exploitable without user interaction.

An advisory published August 19, 2026 describes CVE-2026-19490, a critical authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw carries a CVSS v4.0 base score of 9.3 and is remotely exploitable by unauthenticated attackers over the network without user interaction or elevated privileges. NetScaler ADC and Gateway are widely deployed enterprise products positioned at or near the network perimeter, providing load balancing, SSL/TLS offloading, and secure remote access. The text does not state whether exploitation has been observed in the wild.

Rapid7 BlogAug 19, 16:46 UTC · 28d agoVulnerability CVE-2026-194901

CVE-2026-73749: HPE ArubaOS-CX RCE

HPE patched CVE-2026-73749, a critical unauthenticated remote code execution flaw in ArubaOS-CX network switch software; affected devices need prompt updates.

HPE released patches for CVE-2026-73749, a critical unauthenticated remote code execution vulnerability in HPE Aruba Networking AOS-CX switch operating system. Published details are limited, but the flaw allows unauthenticated attackers to execute code on affected AOS-CX devices. Administrators running ArubaOS-CX should prioritize applying HPE's update.

SOCRadarSep 4, 14:36 UTC · 12d agoVulnerability CVE-2026-73749

Google patches actively exploited Chrome zero-day (CVE-2026-85046)

Google patches actively exploited Chrome zero-day CVE-2026-85046, a V8 type confusion bug enabling sandboxed code execution via crafted HTML pages.

Google patched 12 Chrome vulnerabilities, including CVE-2026-85046, a CVSS 8.8 type confusion flaw in the V8 JavaScript and WebAssembly engine exploited in the wild. The bug, reported by researcher Salvatore Gulizia (Serotav) on August 4, 2026, allows arbitrary code execution inside the sandbox via a crafted HTML page; the researcher described it as a V8 compiler bug enabling arbitrary read/write on the JavaScript heap. Fixes shipped in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, and this is the sixth Chrome zero-day Google has fixed in 2026.

Help Net SecuritySep 8, 06:24 UTC · 8d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-2441 CVE-2026-3909+3 CVEs

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-586 reports a memory corruption RCE (CVE-2026-19886, CVSS 7.8) in OriginLab Origin Viewer OGM file parsing, needing user interaction.

The Zero Day Initiative published advisory ZDI-26-586 describing a memory corruption vulnerability in OriginLab Origin Viewer's OGM file parsing. Exploitation allows remote code execution when a user opens a malicious file or visits a crafted page. ZDI rated the issue CVSS 7.8 and assigned CVE-2026-19886.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19886

CVE-2019-1068: A remote code execution vulnerability exists in ...

CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.

CVE-2019-1068 (CVSS 8.8, CWE-20) is an improper input validation flaw allowing unauthenticated RCE in Microsoft SQL Server 2014 SP2/SP3, 2016, and 2017 on 32-bit and x64 builds. Exploitation requires low complexity and low privileges with no user interaction, and CISA formally added it to the KEV catalog on August 26, 2026. The CVE was originally published on July 15, 2019 and carries an EPSS score of 52.8%. Administrators must inventory affected SQL Server assets and apply vendor patches on an accelerated timeline.

Web discovery (articles for new exploits & KEV entries)Sep 9, 06:32 UTC · 7d agoExploit / PoC in the wildCVE-2019-10681

Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution

Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.

Zoom patched four vulnerabilities, including CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize in the annotation protocol that allows zero-click remote code execution on another participant's device. A Security also found CVE-2026-53414, a buffer overread enabling denial-of-service crashes, and CVE-2026-53415, a use-after-free Zoom had already discovered internally. Updates shipped for Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 across all supported platforms.

Security AffairsAug 11, 17:48 UTC · Aug 11, 2026Vulnerability CVE-2026-53413 CVE-2026-53414 CVE-2026-53415