30
3 Vulnerabilities Found on AvertX IP Cameras
Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.
Palo Alto Networks Unit 42 researchers found three vulnerabilities in AvertX HD838 and 438IR outdoor surveillance cameras, which are rebranded Hikvision products: CVE-2020-11625 (user enumeration), CVE-2020-11624 (weak password requirements), and CVE-2020-11623 (exposed dangerous method/function). User enumeration responses facilitate brute-force attacks, the default admin credentials (admin/1234) are never enforced to change, and physical access to an exposed UART interface allows bootloader access and configuration modification. AvertX released a patch, removed the UART connector, and disabled the interface in the latest production batch.
26
VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.
CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.
25
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.
Wordfence published its weekly WordPress Vulnerability Report covering disclosures between August 31 and September 6, 2026. The report lists new vulnerabilities added to the Wordfence Intelligence Vulnerability Database and highlights contributors to WordPress Security. Administrators are advised to review the listed plugin and theme vulnerabilities to check whether their sites are affected.
12
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)
Wordfence logged 240 disclosed vulnerabilities across 184 WordPress plugins and 17 themes for the week of August 17-23, 2026.
Wordfence's weekly WordPress vulnerability report for August 17-23, 2026 added 240 vulnerabilities to its Intelligence Vulnerability Database, affecting 184 plugins and 17 themes. 105 vulnerability researchers contributed during the period. WordPress administrators are advised to review the list to check whether their sites use affected components.
26
30
30
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Wordfence's weekly report summarizes newly disclosed WordPress ecosystem vulnerabilities added to its intelligence database for August 24-30, 2026.
Wordfence published its weekly WordPress vulnerability report covering disclosures added to the Wordfence Intelligence Vulnerability Database between August 24 and August 30, 2026. The report directs site owners to review the aggregated vulnerabilities to determine whether their sites are affected. The published text provides no specific CVE identifiers or affected products.
12
30
Cisco Unified Intelligence Center SQL Injection Vulnerability
Cisco patched a blind SQL injection in Unified Intelligence Center's web interface allowing authenticated local attackers to read the internal database.
Cisco disclosed a blind SQL injection vulnerability in the web-based management interface of Unified Intelligence Center, caused by insufficient validation of user-supplied input. An authenticated local attacker can send crafted requests and read the contents of the device's internal database. Exploitation requires valid user credentials, and Cisco has released software updates.
26
30
VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability
Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.
CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.
24
ZDI-26-601: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-13129, CVSS 3.3) allowing sensitive information disclosure when a user opens malicious content.
ZDI-26-601 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13129 with a CVSS score of 3.3. Successful exploitation allows remote attackers to disclose sensitive information, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
15
Cisco RoomOS Stack Overflow Vulnerability
Cisco fixed a stack overflow in the RoomOS USB driver allowing physical-access attackers to execute code with root privileges.
Insufficient boundary checks in the USB driver of Cisco RoomOS allow a buffer overflow when specific data is supplied through the USB port. An unauthenticated local attacker with physical access can connect a malicious USB device and execute arbitrary code with root privileges. Cisco has released software updates and no workarounds address the issue.
21
Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability
Cisco fixed a stored cross-site scripting flaw in Industrial Ethernet 1000 series switches exploitable by authenticated remote users.
Insufficient validation of user-supplied input in the web-based management interface of Cisco Industrial Ethernet 1000 Series Switches allows stored XSS. An authenticated remote attacker can inject malicious code into specific interface pages and execute arbitrary script in another user's context. Exploitation requires valid credentials; Cisco has released software updates.
22
Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
Cisco disclosed a UEFI Secure Boot bypass in UCS servers and UCS-based appliances letting authenticated or physically present attackers execute unauthorized software.
Cisco published an advisory for a vulnerability in the UEFI Shell implementation of UCS servers and UCS-based appliances. Memory write commands remain available in the UEFI Shell while Secure Boot is enabled, allowing an attacker to modify UEFI memory and bypass validation checks to run unauthorized software. Exploitation requires either valid credentials for a user or admin account, or unauthenticated physical access to select the UEFI Shell boot option at boot time. The issue affects firmware boot integrity rather than the running operating system.
20
CareCam Pro IP Cameras
CISA advisory details hard-coded bootloader credential CVE-2026-85083 in ANJIA AJL33PC0801 CareCam Pro cameras, allowing physical-access firmware compromise.
CISA ICS advisory ICSA-26-251-01 describes CVE-2026-85083, a hard-coded credential (CWE-798) used for bootloader authentication in the ANJIA AJL33PC0801 CareCam Pro IP camera. An attacker with physical access could gain privileged bootloader access and modify firmware and configuration, potentially fully compromising the device. The flaw scores 6.8 on CVSS 3.1 (7.0 on CVSS 4.0), is not remotely exploitable, and no public exploitation has been reported. Affected firmware is linux_linux_202008261138_svn13796 with U-Boot 2010.06; the vendor is headquartered in China with worldwide deployments.
18
OPCFoundation OPC UA LocalDiscoveryServer (LDS)
CISA warns CVE-2026-77477 (CVSS 4.6) lets local attackers hijack a privileged console during OPC UA LDS installation below version 1.04.420.
CISA published ICSA-26-246-01 for CVE-2026-77477, CWE-250 execution with unnecessary privileges in OPC Foundation UA-LDS-Installers below 1.04.420. An attacker able to launch the installer with elevated privileges and access the keyboard and display can intercept a high-privilege console window during installation and run arbitrary commands. CVSS 3.1 score is 4.6, the issue is not remotely exploitable, and no public exploitation has been reported. Lukas Schumaker of Rockwell Automation reported the flaw to OPC Foundation.
15
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
Cisco warns of a DoS flaw in SIP software on Desk Phone 9800 and IP Phone 7800/8800 series from improper HTTP packet memory handling.
Cisco disclosed a denial of service vulnerability affecting Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 devices running Cisco SIP Software. An unauthenticated remote attacker can send a continuous stream of crafted HTTP packets, causing sustained memory consumption until the device becomes unresponsive. A manual reboot is required to recover an affected device. No CVE identifier was listed in the advisory text.
20
[hardware] Fullhan FH8626V100 - Multiple Vulnerabilities
Multiple vulnerabilities in the Fullhan FH8626V100 hardware chip have been disclosed alongside public proof-of-concept exploits.
Exploit-DB lists an entry covering multiple vulnerabilities in the Fullhan FH8626V100, a hardware component. The listing provides no CVE ids, vulnerability classes, or evidence of in-the-wild exploitation. Impact is likely limited to devices embedding the affected chip.
18
Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability
Cisco released a fix for a management-plane flooding DoS in IE-1000 switches that can make the device manager, SSH, or API inaccessible.
Insufficient protection against management plane flooding in Cisco Industrial Ethernet 1000 Series Switches allows an unauthenticated remote attacker to send high-rate ICMP, SSH, or HTTP traffic, raising CPU usage and causing a denial-of-service condition on the device manager web GUI, SSH, or API. Data traffic through the device is not affected. Cisco has released software updates to address the issue.
18
USN-8760-1: Linux kernel (NVIDIA) vulnerabilities
Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.
Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.
12
ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses an uninitialized-memory flaw in Linux kernel IPv6 neighbor discovery (CVE-2026-43040, CVSS 6.0) allowing information disclosure by already-privileged local attackers.
ZDI advisory ZDI-26-682 describes an uninitialized memory vulnerability in the Linux kernel's IPv6 Neighbour Discovery code, tracked as CVE-2026-43040 with a CVSS score of 6.0. Exploitation requires the attacker to already execute high-privileged code on the target, which severely limits practical impact to kernel memory information disclosure. No active exploitation is mentioned.
15
ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.
ZDI-26-701 covers an out-of-bounds read information disclosure vulnerability in the Linux Kernel TLS protocol implementation, tracked as CVE-2026-64046 with a CVSS rating of 6.7. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
18
ZDI-26-698: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI-26-698: Linux Kernel NTFS3 out-of-bounds read (CVSS 5.2) allows local attackers to disclose sensitive information on affected systems.
ZDI advisory ZDI-26-698 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 5.2. Exploitation requires the attacker to first obtain the ability to execute low-privileged code on the target. The impact is limited to local information disclosure. No CVE identifier is listed in the advisory.
15
ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.
ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
18
ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI advisory ZDI-26-669 details an out-of-bounds read (CVE-2026-81978) when Adobe Acrobat Reader DC parses JBIG2 files.
The Zero Day Initiative published advisory ZDI-26-669 for an out-of-bounds read triggered when Acrobat Reader DC parses JBIG2 files. Successful exploitation allows a remote attacker to disclose sensitive information from affected installations. User interaction is required, such as opening a malicious file or visiting a malicious page. ZDI rated the issue 3.3 and assigned CVE-2026-81978.
15
ZDI-26-643: Oracle VirtualBox VMSVGA Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI publishes ZDI-26-643 for CVE-2026-60162, an out-of-bounds read information disclosure flaw in Oracle VirtualBox VMSVGA, rated CVSS 6.1.
Zero Day Initiative published advisory ZDI-26-643 describing an out-of-bounds read in Oracle VirtualBox's VMSVGA component. Local attackers with the ability to execute high-privileged code on the guest system can disclose sensitive information. ZDI rated the issue CVSS 6.1 and assigned CVE-2026-60162.
18
ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability
ZDI published ZDI-26-626 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bzfilelist component.
The Zero Day Initiative published advisory ZDI-26-626 describing a link-following denial-of-service vulnerability in the bzfilelist component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.
22
ZDI-26-631: NI LabVIEW VI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI disclosed CVE-2026-18444, an out-of-bounds read in NI LabVIEW VI file parsing that can disclose sensitive information, rated CVSS 3.3.
The Zero Day Initiative published advisory ZDI-26-631 describing an out-of-bounds read vulnerability in NI LabVIEW's parsing of VI files. Exploitation can disclose sensitive information and requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI assigned the flaw a CVSS rating of 3.3.
15
Re: Vulnerability fixes in util-linux-2.42.3
util-linux 2.42.3 includes vulnerability fixes, with a commit link shared for downstream tracking but no CVEs cited.
An oss-security post links a util-linux commit (286dd3ff41526b582ef48830de239dffbaa61f90) as part of the 2.42.3 vulnerability fix release. No CVE identifiers, flaw descriptions, or exploitation details are provided. The item is a routine open-source fix notification for downstream distributors.
22
ZDI-26-615: (0Day) pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Zero Day Initiative disclosed an uncontrolled search path flaw in pdfforge PDF Architect's update service, allowing local privilege escalation (CVSS 7.8).
ZDI published advisory ZDI-26-615 describing a local privilege escalation vulnerability in the activation-service Update Service of pdfforge PDF Architect. An uncontrolled search path element lets local attackers escalate privileges, but they must first be able to execute low-privileged code on the target. ZDI rated the issue 7.8 and tagged it as a 0-day disclosure.
22
ZDI-26-600: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader annotation use-after-free (CVE-2026-57237, CVSS 3.3) can disclose sensitive information when users open malicious PDFs.
ZDI-26-600 documents a use-after-free in Foxit PDF Reader annotation handling that allows remote information disclosure, tracked as CVE-2026-57237 with CVSS 3.3. Exploitation requires user interaction such as opening a malicious file or visiting a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.
15
ZDI-26-596: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader out-of-bounds read in PDF parsing (CVE-2026-57253, CVSS 3.3) can leak sensitive information via malicious files.
ZDI-26-596 covers an out-of-bounds read in Foxit PDF Reader's PDF file parsing, tracked as CVE-2026-57253 and rated CVSS 3.3. Successful exploitation allows remote attackers to disclose sensitive information and requires the target to open a malicious file or page. The advisory was published by the Zero Day Initiative on August 24, 2026.
15
ZDI-26-606: Microsoft Windows Compatibility Appraiser Link Following Local Privilege Escalation Vulnerability
ZDI disclosed a link-following flaw in Windows Compatibility Appraiser (CVSS 7.0) enabling local privilege escalation from the LOCAL SERVICE context.
ZDI-26-606 describes a link-following vulnerability in the Windows Compatibility Appraiser component that permits local privilege escalation. An attacker must already be able to execute low-privileged code in the LOCAL SERVICE context on the target system. ZDI rated the issue 7.0 on the CVSS scale; the advisory lists no CVE identifier. No active exploitation is reported.
18
ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability
ZDI disclosed an HTML injection flaw in Microsoft Office (CVSS 7.6) that lets remote attackers disclose sensitive information via malicious pages or files.
Zero Day Initiative advisory ZDI-26-607 describes an HTML injection vulnerability in Microsoft Office that leads to information disclosure. Remote attackers need the target to visit a malicious page or open a malicious file to trigger it. ZDI rated the issue 7.6 on the CVSS scale and the advisory lists no CVE identifier. The advisory does not indicate active exploitation.
18
ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability
ZDI disclosed a server-side request forgery in Fabric.js loadFromJSON (CVE-2026-19504) that can leak sensitive information from affected implementations.
Zero Day Initiative advisory ZDI-26-588 describes a server-side request forgery vulnerability in the Fabric.js canvas library's loadFromJSON function. Exploitation requires interaction with the library and attack vectors vary by implementation, potentially exposing sensitive information. The issue is rated 4.0 on the CVSS scale and tracked as CVE-2026-19504. The advisory does not report exploitation in the wild.
15
ZDI-26-599: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
ZDI published advisory ZDI-26-599 for a use-after-free information disclosure flaw (CVE-2026-57238, CVSS 3.3) in Foxit PDF Reader requiring user interaction.
The Zero Day Initiative released advisory ZDI-26-599 describing a use-after-free vulnerability in Foxit PDF Reader's annotation handling. The flaw allows remote attackers to disclose sensitive information when a target opens a malicious file or visits a malicious page. ZDI rated the issue CVSS 3.3 and assigned CVE-2026-57238.
12
ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability
ZDI advisory ZDI-26-605 details an improper input validation flaw (CVE-2026-50508, CVSS 3.3) in Microsoft Windows localized filenames that leaks NTLM responses.
The Zero Day Initiative released advisory ZDI-26-605 describing improper input validation in Microsoft Windows handling of localized filenames. Remote attackers can disclose NTLM authentication responses if the target opens a malicious file or visits a crafted page. ZDI rated the issue CVSS 3.3 and assigned CVE-2026-50508. Leaked NTLM responses could enable offline credential cracking.
15
ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability
The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.
ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.
25