ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “forgery”

729 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 324Exploit / PoC 166Phishing & fraud 59Ransomware 40Data breach 29Malware 28Policy & legal 20Advisory 19Threat actor 17Industry 10Research 9AI safety & security 5AI tools & infra 3Tools 2
SeverityAllcritical 367high 158medium 123low 67info 18

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security · 2d agoVulnerabilityCVE-2026-87802

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA Advisories · 6d agoAdvisoryCVE-2026-38059CVE-2026-38057CVE-2026-38056+1 CVEs

Harnessing CLIP and DINO: An Uncertainty-Aware Cascaded Fusion Network for Generalizable Deepfake Image Detection

UCF-Net fuses CLIP and DINO features with entropy-based uncertainty weighting to improve generalizable deepfake image detection across generators.

Researchers propose UCF-Net, an uncertainty-aware cascaded fusion network that combines CLIP's language-aligned semantic priors with DINO's self-supervised visual-structure priors for deepfake detection. It aggregates hierarchical features across transformer depths via layer-wise expert modules and performs weighted fusion driven by entropy-derived uncertainty. The authors consolidate public deepfake datasets into a unified benchmark of roughly 4 million images plus a cross-generator set of over 8,000 faces from eight recent generators, where UCF-Net achieves the best mean AUC among evaluated methods, though zero-shot transfer remains challenging.

Hugging Face daily papers · 10d agoAI research

U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.

CISA added CVE-2026-64849, a critical unauthenticated server-side request forgery in MLflow, to its Known Exploited Vulnerabilities catalog. The flaw affects MLflow versions before 3.15.0 and allows unauthenticated attackers to reach internal services including cloud metadata endpoints, exposing temporary cloud credentials. watchTowr observed in-the-wild exploitation exfiltrating credentials and secrets, plus widespread scanning of exposed MLflow instances within hours of the CVE's assignment on August 17, 2026. MLflow is an open-source platform for managing the machine learning and AI development lifecycle with over 60 million monthly downloads.

Security Affairs · 27d agoExploit / PoC in the wildCVE-2026-64849

[webapps] webpack_devserver 5.2.5 - CSRF

Exploit-DB published a cross-site request forgery proof of concept for webpack_devserver 5.2.5.

Exploit-DB lists a webapps CSRF proof-of-concept against webpack_devserver version 5.2.5. The flaw affects the local webpack development server, where cross-site requests could be issued against it. No CVE id is cited in the entry and no active exploitation is reported.

Exploit-DB · Aug 17, 2026Exploit / PoC

[webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak

A public exploit exposes JWT signing key leakage in backup software Duplicati 2.2.0.3, risking session forgery.

Exploit-DB published exploit #52646 for Duplicati 2.2.0.3, a backup application. The issue leaks the JWT signing key, which could let an attacker forge authentication tokens. The disclosure does not report any exploitation in the wild.

Exploit-DB · Aug 17, 2026Exploit / PoC