ZDI publishes four advisories, including unauthenticated NoMachine and OpenSSL flaws
First merged summary.
On October 22, ZDI published four advisories with CVSS scores from 3.1 to 9.8 and no patches or exploitation status.
ZDI published four separate advisories on October 22, 2026, without naming affected or fixed versions or saying any flaw is exploited. ZDI-26-786 rates a heap-based buffer overflow in NoMachine nxwebrunner, CVE-2026-114549, at CVSS 9.8; remote attackers can execute code without authentication. ZDI-26-787 rates YAML parsing code injection in NVIDIA Megatron Bridge, CVE-2026-24250, at CVSS 7.8 and requires a user to open a malicious page or file. ZDI-26-789 rates an OpenSSL CMP externally controlled format-string flaw, CVE-2026-63073, at CVSS 6.5 for unauthenticated information disclosure. ZDI-26-790 rates improper integrity-check validation in OpenSSL CMS AuthEnvelopedData, CVE-2026-34182, at CVSS 3.1 and requires an attacker who can already modify those messages.
- ZDI-26-786: NoMachine nxwebrunner heap overflow, CVE-2026-114549, CVSS 9.8, no authentication.
- ZDI-26-787: NVIDIA Megatron Bridge YAML injection, CVE-2026-24250, CVSS 7.8, user interaction required.
- ZDI-26-789: OpenSSL CMP format string, CVE-2026-63073, CVSS 6.5, unauthenticated disclosure.
- ZDI-26-790: OpenSSL CMS AuthEnvelopedData integrity check, CVE-2026-34182, CVSS 3.1.
- None of the four snippets names versions, patches, or confirmed exploitation.
Timeline
dated events in the reporting · oldest first- Oct 22, 2026ZDI publishes four advisories covering NoMachine, NVIDIA, and OpenSSL. · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesCVSS scores, CVE IDs, and exploitation preconditions for all four flaws.
- Products
- nxwebrunnerMegatron Bridge
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 3d ago
ZDI Published AdvisoriesFirst report
NVIDIA Megatron Bridge YAML parsing bug enables code execution
CVE-2026-24250 requires a user to open a malicious file or page; ZDI rates it CVSS 7.8.
- · 3d ago
NoMachine nxwebrunner heap overflow allows unauthenticated RCE
ZDI rates CVE-2026-114549 at CVSS 9.8; the snippet names no versions and no confirmed attacks.
- · 3d ago
OpenSSL CMP format-string flaw can leak data without login
ZDI rates CVE-2026-63073 at CVSS 6.5; remote attackers need no authentication, and no fixed version is named.
- · 3d ago
OpenSSL CMS integrity-check flaw lets attackers tamper with messages
ZDI rates CVE-2026-34182 at CVSS 3.1 and says the attacker must already be able to modify the messages.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114549 | — | — | — | ||
| CVE-2026-24250 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs | 7.8 | <1% | ||
| CVE-2026-34182 | Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of… | 9.1 | <1% | ||
| CVE-2026-63073 | Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()` | 9.8 | <1% |