47
60
42
UNISOC Modem Flaw Enables Remote Code Execution via Video Calls
A UNISOC modem flaw allows attackers to achieve kernel-level remote code execution through malicious video calls on affected devices.
UNISOC, whose modems are widely deployed in Android smartphones, has a flaw that enables kernel-level code execution triggered via video calls. Successful exploitation would give an attacker deep control over affected handsets. No exploitation activity is mentioned in the report.
65
Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...
ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.
Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.
65
cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root
cPanel disclosed CVE-2026-67401, an authenticated SQL injection in EmailTrack that lets attackers write files and execute code as root.
cPanel disclosed CVE-2026-67401 on September 8, 2026: a SQL injection in the EmailTrack feature that allows authenticated account holders with mail-related permissions to create arbitrary files and execute code with root privileges. Fixes shipped in v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and WP2 channel v11.138.1.9, with all supported versions before those releases affected. Root-level execution poses severe risk to shared hosting providers and multi-tenant servers, as it removes isolation between cPanel accounts, websites, mailboxes, and backups. Researchers Ali Mustafa (rz1027) and abed1526 responsibly reported the flaw.
52
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
82
47
57
60
47
60
47
Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access
Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.
Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.
55
60
Vulnerability Spotlight: Apple Safari SVG marker element baseVal remote code execution vulnerability
60
60
47
60
60
60
47
47
47
60
47
47
60
42
47
60
60
60
60
47
Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.
Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID caused by deserialization of untrusted data, and said the issue was fully mitigated on the service side with no customer action required. The security bulletin initially marked the flaw as exploited, but Microsoft corrected the status to not exploited in the wild on August 21, 2026. Microsoft credited principal security engineer Robert Fitzpatrick with the discovery. The article also recalls the Lazarus Group's exploitation of Windows WinSock AFD zero-day CVE-2026-68820 (CVSS 7.0) in the Operation Dream Job campaign.
66
ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability
ZDI discloses an unauthenticated code injection remote code execution flaw in Flowise's Airtable_Agent (CVE-2026-69264, CVSS 9.8).
ZDI advisory ZDI-26-546 describes a code injection vulnerability in the Flowise Airtable_Agent that allows remote attackers to execute arbitrary code. No authentication is required to exploit the flaw, which carries a CVSS rating of 9.8 and is assigned CVE-2026-69264. Flowise deployments exposing the vulnerable agent component are at risk of full server takeover.
42
47
ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability
ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.
ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.
35
Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root
JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.
JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.
62