Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,172 stories synthesized.
Fortinet disclosed an out-of-bounds write vulnerability in the FortiWeb CGI daemon that could allow a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.
A stack-based buffer overflow in HP DeskJet 2855e printers, disclosed by ZDI and demonstrated at Pwn2Own, lets unauthenticated network-adjacent attackers execute arbitrary code as root.
A critical memory corruption vulnerability in NI LabVIEW's LVLIB file parsing, tracked as CVE-2026-32860, allows remote code execution via a malicious file or webpage.
A critical out-of-bounds write vulnerability in Fortinet FortiWeb, tracked as CVE-2026-40688, allows authenticated remote attackers to execute arbitrary code with root privileges.
A critical stack-based buffer overflow vulnerability in GStreamer's qtdemux parser, tracked as CVE-2026-5056, allows remote attackers to execute arbitrary code via specially crafted media files.
A critical unauthenticated remote code execution vulnerability in QNAP TS-453E devices running the QVRPro Plugin allows network-adjacent attackers to execute arbitrary code as the postgres user.
Microsoft has released a security update for CVE-2026-32073, a CVSS 7.8 race condition in the afd.sys driver that lets low-privileged attackers gain kernel-level code execution on Windows.
A newly disclosed vulnerability in Adobe ColdFusion, tracked as CVE-2026-34619, allows authenticated remote attackers to delete arbitrary files through a directory traversal flaw in the deleteVersion method.
A 0-day privilege escalation vulnerability in Docker Desktop has been publicly disclosed after Docker rejected the report, allowing attackers with container escape access to execute arbitrary code on the host system.
ATEN has released a security update for a critical missing-authentication vulnerability in its Unizon management platform that allows unauthenticated remote attackers to trigger a denial-of-service condition.
Adobe has released a security update for ColdFusion to fix CVE-2026-27282, an authentication bypass vulnerability in the subscribeToEndpoints method that could allow unauthenticated remote attackers to delete arbitrary files.
A command injection vulnerability in Microsoft Qlib's _mount_nfs_uri function allows unauthenticated, network-adjacent attackers to execute arbitrary code as root.
A critical heap-based buffer overflow vulnerability in GIMP's HDR file parsing, tracked as CVE-2026-2050, allows attackers to execute arbitrary code by tricking users into opening a malicious file.
A directory traversal vulnerability in DriveLock's web service, tracked as CVE-2026-5492, allows authenticated remote attackers to read arbitrary files from the server, potentially exposing sensitive configuration data and credentials.
A critical directory traversal vulnerability in DriveLock's web service allows unauthenticated remote attackers to read arbitrary files, with a CVSS score of 7.5.
A local privilege escalation vulnerability in Samsung MagicINFO 9 Server, tracked as CVE-2026-25203, allows attackers with low-privileged access to gain SYSTEM-level control; a fix is available in version 21.1091.1.
Microsoft has patched CVE-2026-26179, a double-free vulnerability in the Windows Secure Kernel that could let an attacker with high-privileged code execution escalate to the VTL1 Secure Kernel.
A local privilege escalation vulnerability in Malwarebytes Anti-Malware allows low-privileged attackers to gain SYSTEM access via an uncontrolled search path element, fixed in version 1.0.6.31.
A critical directory traversal vulnerability (CVE-2025-54987) in TrendAI Apex One Console allows unauthenticated remote attackers to execute arbitrary code on TCP ports 8080 and 4343.
A critical SQL injection vulnerability in DriveLock's web service allows authenticated attackers to escalate privileges via SQL injection, with a CVSS score of 8.8.
A memory corruption vulnerability in NI LabVIEW's LVCLASS file parsing (CVE-2026-32861, CVSS 7.8) allows remote code execution via a malicious file, with a patch now available.
A directory traversal vulnerability in DriveLock's web service allows unauthenticated remote attackers to read sensitive files, with a CVSS score of 5.3 and a patch now available.
A newly disclosed integer overflow vulnerability in Fortinet FortiWeb (CVE-2026-39811) allows authenticated remote attackers to cause a denial-of-service condition via crafted HTTP requests.
Microsoft has released a patch for CVE-2026-33104, a local privilege escalation vulnerability in the win32kfull driver that allows attackers with low-privileged code execution to gain SYSTEM privileges.