Aggregator

A vulnerability was found in Linux Kernel up to 7.1.3 and classified as critical. The impacted element is the function inode_switch_wbs/cleanup_offline_cgwb of the file fs/super.c of the component Writeback. Executing a manipulation of the argument s_flags can lead to use after free. This vulnerability is registered as CVE-2026-64378. The attack needs to be launched locally. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability categorized as problematic has been discovered in FreeRDP up to 3.28.x. The impacted element is an unknown function of the component Clipboard. The manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2026-67305. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in OPeNDAP Hyrax 1.18.0 and classified as critical. This issue affects some unknown processing. The manipulation results in server-side request forgery. This vulnerability is identified as CVE-2026-16637. The attack can be executed remotely. There is not any exploit available.

A vulnerability classified as critical was found in Sean Barrett nothings stb up to 1.26. This vulnerability affects the function stbtt__GetGlyphShapeTT of the file stb_truetype.h of the component TrueType font file Parser. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is handled as CVE-2026-18497. The attack can be executed remotely. There is not any exploit available.

A vulnerability marked as critical has been reported in OpenCart 4.2.0.0. The affected element is an unknown function of the component Extension Installer. Performing a manipulation results in path traversal. This vulnerability is reported as CVE-2026-18412. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as problematic has been found in Trusted Computing Group TPM up to 184. This impacts an unknown function. The manipulation results in incorrect type conversion. This vulnerability was named CVE-2026-6726. The attack needs to be approached locally. There is no available exploit.

A vulnerability marked as problematic has been reported in Trusted Computing Group TPM up to 184. Affected is an unknown function of the component RSA OAEP Decryption Implementation. This manipulation causes observable timing discrepancy. The identification of this vulnerability is CVE-2026-6727. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as critical has been found in Linux Kernel up to 6.12.96/6.18.38/7.1.3. Affected is the function load_unaligned_zeropad of the component s390. Such manipulation leads to infinite loop. This vulnerability is uniquely identified as CVE-2026-64369. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A forum actor posting as Marx is advertising access to what they describe as a live database of messaging records belonging to Transfast, a cross border payment network acquired by Mastercard in 2019 and now operating as part of its transaction services business.

A vulnerability has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2026-86307. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in pmmp PocketMine-MP up to 3.26.4/4.0.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Skin Data. The manipulation of the argument skinID/geometryName results in improper input validation. This vulnerability is cataloged as CVE-2022-51017. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in itsourcecode School Management System 1.0. It has been declared as critical. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. This vulnerability is identified as CVE-2026-86268. The attack can be executed remotely. Additionally, an exploit exists.

Две системы сохранили широкие орбиты там, где звёзды должны были столкнуться или сблизиться почти вплотную.

A vulnerability categorized as problematic has been discovered in envothemes Envos Templates & Widgets for Elementor and WooCommerce Plugin up to 1.4.26 on WordPress. This vulnerability affects the function render of the component Elementor Editor REST API. Executing a manipulation can lead to missing authorization. This vulnerability is handled as CVE-2026-11600. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability marked as critical has been reported in Royal MCP Plugin up to 1.4.25 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to missing authorization. This vulnerability is referenced as CVE-2026-10750. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Ivanti has disclosed a wave of security advisories affecting three flagship enterprise products, Endpoint Manager Mobile, Neurons for ITSM, and Sentry, exposing organizations to risks ranging from privilege escalation to full remote code execution. The disclosures, published on September 8, 2026, cover ten distinct CVEs, several rated critical, underscoring the breadth of exposure across Ivanti’s […]

The post Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks appeared first on Cyber Security News.

WeWorm是Calif Research演示的微信语音通话零点击蠕虫，跨iOS/Android平台，无需用户交互即可接管微信账号。腾讯已修复，更新即可。这个漏洞是微信VoIP（网络电话）堆栈中的一个内存损坏问题。 一旦利用成功，攻击者获得的是微信账号的完全控制权。可以读取和发送消息，可以拨打电话，可以以受害者的身份进行任何操作。这还不是终点，如果再结合其他已经报告并正在修复的Android和iOS系统漏洞，甚至可以实现对整个设备的完全控制。 这个漏洞有一个前提条件，攻击者必须在受害者的微信好友列表里。乍一看这似乎是个限制，但仔细想想就会发现这并不是什么真正的障碍。攻击者完全可以先入侵你某个朋友的账号，然后用朋友的身份来拨打你的电话。

Anthropic 和美国国防部之间公开上演的决裂事件吸引过不少外界目光，这场冲突表面上围绕二十一世纪战争伦理

A vulnerability, which was classified as problematic, has been found in dzzoffice 2.02.1_SC_UTF8. Affected is an unknown function. Performing a manipulation results in cross-site request forgery. This vulnerability is cataloged as CVE-2022-43340. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability identified as critical has been detected in Telenia TVox. Affected by this vulnerability is an unknown functionality of the file action_export_control.php. The manipulation leads to privilege escalation. This vulnerability is listed as CVE-2022-43333. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.