Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,942 stories synthesized.
A heap-based buffer overflow in the Philips Hue Bridge's HomeKit Pair-Setup functionality, disclosed at Pwn2Own, allows unauthenticated network-adjacent attackers to execute arbitrary code.
A local privilege escalation vulnerability in Docker Desktop's plugins directory handling, tracked as CVE-2025-15558, allows attackers with low-privileged code execution to gain elevated access; Docker has released a fix.
A critical heap-based buffer overflow vulnerability in GStreamer's rtpqdm2depay element, tracked as CVE-2026-3085, allows remote attackers to execute arbitrary code via specially crafted X-QDM RTP payloads.
A stack-based buffer overflow in GStreamer's H.266 codec parser, tracked as CVE-2026-3081, allows remote attackers to execute arbitrary code on affected systems.
A heap-based buffer overflow in the Philips Hue Bridge's hap_pair_verify_handler function, disclosed via Pwn2Own, allows network-adjacent attackers to bypass authentication and execute arbitrary code as root.
A heap-based buffer overflow in GStreamer's ASF demuxer, tracked as CVE-2026-2920, allows remote code execution when users open specially crafted ASF files, with a CVSS score of 7.8.
A vulnerability in the Philips Hue Bridge (CVE-2026-3562, CVSS 6.3) allows network-adjacent attackers to bypass authentication and execute arbitrary code via improper Ed25519 signature verification.
A newly disclosed integer overflow vulnerability in GStreamer's handling of palette data in AVI files allows remote attackers to execute arbitrary code on affected systems.
A critical out-of-bounds write vulnerability in GStreamer's rtpqdm2depay element, tracked as CVE-2026-3083, allows remote attackers to execute arbitrary code via crafted X-QDM RTP payloads.
A critical heap-based buffer overflow in the Philips Hue Bridge's HomeKit implementation, disclosed at Pwn2Own, allows network-adjacent attackers to execute arbitrary code without authentication.
A heap-based buffer overflow in the Philips Hue Bridge's Zigbee stack, disclosed at Pwn2Own, lets network-adjacent attackers execute arbitrary code by tricking a user into pairing a malicious device.
A critical out-of-bounds write vulnerability in Delta Electronics CNCSoft-G2's DOPSoft module allows remote attackers to execute arbitrary code by tricking users into opening a malicious DPAX file.
A critical authentication bypass vulnerability in the Philips Hue Bridge, CVE-2026-3558, was disclosed after being demonstrated at Pwn2Own, allowing network-adjacent attackers to bypass security controls without authentication.
A high-severity out-of-bounds write vulnerability in GStreamer's DVB subtitle handling, tracked as CVE-2026-2923, allows remote attackers to execute arbitrary code via specially crafted subtitle data.
ZDI discloses CVE-2026-2922, a critical out-of-bounds write vulnerability in GStreamer's RealMedia Demuxer that allows remote code execution via crafted video packets, with a CVSS score of 7.8.
A heap-based buffer overflow in GStreamer's JPEG parser, tracked as CVE-2026-3082, allows remote code execution via crafted input and carries a CVSS score of 7.8.
A static nonce vulnerability in the Philips Hue Bridge's HomeKit Accessory Protocol allows network-adjacent attackers to bypass SRP authentication without credentials, a flaw demonstrated at Pwn2Own.
A heap-based buffer overflow in the Philips Hue Bridge (CVE-2026-3561) allows network-adjacent attackers to execute arbitrary code, with authentication bypass possible; the flaw was demonstrated at Pwn2Own and patched in firmware version 1975170000.
Trend Micro researchers detail the BoryptGrab stealer campaign, which uses SEO-poisoned GitHub repositories and fake download pages to deliver a data-stealing malware family with a reverse SSH backdoor to Windows users.
Law enforcement and industry partners seized over 300 domains tied to Tycoon 2FA, a major phishing-as-a-service platform that bypassed multi-factor authentication using adversary-in-the-middle proxying.
A critical pre-authentication remote code execution vulnerability in Juniper's Junos OS Evolved, CVE-2026-21902, allows unauthenticated attackers to take full control of PTX Series routers.
A server-side request forgery vulnerability in Trend Micro Apex Central's Scheduled Update feature could allow authenticated attackers to probe internal networks.
A privilege escalation vulnerability in Trend Micro Apex Central, tracked as CVE-2025-71208, allows authenticated attackers to gain elevated access to protected resources.
A critical remote code execution vulnerability (CVE-2026-27794) in LangChain's LangGraph BaseCache class allows unauthenticated attackers to achieve code execution via deserialization of untrusted data.