Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,561 stories synthesized.
A heap-based buffer overflow in GStreamer's ASF demuxer, tracked as CVE-2026-2920, allows remote code execution when users open specially crafted ASF files, with a CVSS score of 7.8.
A vulnerability in the Philips Hue Bridge (CVE-2026-3562, CVSS 6.3) allows network-adjacent attackers to bypass authentication and execute arbitrary code via improper Ed25519 signature verification.
A newly disclosed integer overflow vulnerability in GStreamer's handling of palette data in AVI files allows remote attackers to execute arbitrary code on affected systems.
A critical out-of-bounds write vulnerability in GStreamer's rtpqdm2depay element, tracked as CVE-2026-3083, allows remote attackers to execute arbitrary code via crafted X-QDM RTP payloads.
A critical heap-based buffer overflow in the Philips Hue Bridge's HomeKit implementation, disclosed at Pwn2Own, allows network-adjacent attackers to execute arbitrary code without authentication.
A heap-based buffer overflow in the Philips Hue Bridge's Zigbee stack, disclosed at Pwn2Own, lets network-adjacent attackers execute arbitrary code by tricking a user into pairing a malicious device.
A critical out-of-bounds write vulnerability in Delta Electronics CNCSoft-G2's DOPSoft module allows remote attackers to execute arbitrary code by tricking users into opening a malicious DPAX file.
A critical authentication bypass vulnerability in the Philips Hue Bridge, CVE-2026-3558, was disclosed after being demonstrated at Pwn2Own, allowing network-adjacent attackers to bypass security controls without authentication.
A high-severity out-of-bounds write vulnerability in GStreamer's DVB subtitle handling, tracked as CVE-2026-2923, allows remote attackers to execute arbitrary code via specially crafted subtitle data.
ZDI discloses CVE-2026-2922, a critical out-of-bounds write vulnerability in GStreamer's RealMedia Demuxer that allows remote code execution via crafted video packets, with a CVSS score of 7.8.
A heap-based buffer overflow in GStreamer's JPEG parser, tracked as CVE-2026-3082, allows remote code execution via crafted input and carries a CVSS score of 7.8.
A static nonce vulnerability in the Philips Hue Bridge's HomeKit Accessory Protocol allows network-adjacent attackers to bypass SRP authentication without credentials, a flaw demonstrated at Pwn2Own.
A heap-based buffer overflow in the Philips Hue Bridge (CVE-2026-3561) allows network-adjacent attackers to execute arbitrary code, with authentication bypass possible; the flaw was demonstrated at Pwn2Own and patched in firmware version 1975170000.
Trend Micro researchers detail the BoryptGrab stealer campaign, which uses SEO-poisoned GitHub repositories and fake download pages to deliver a data-stealing malware family with a reverse SSH backdoor to Windows users.
Law enforcement and industry partners seized over 300 domains tied to Tycoon 2FA, a major phishing-as-a-service platform that bypassed multi-factor authentication using adversary-in-the-middle proxying.
A critical pre-authentication remote code execution vulnerability in Juniper's Junos OS Evolved, CVE-2026-21902, allows unauthenticated attackers to take full control of PTX Series routers.
A server-side request forgery vulnerability in Trend Micro Apex Central's Scheduled Update feature could allow authenticated attackers to probe internal networks.
A privilege escalation vulnerability in Trend Micro Apex Central, tracked as CVE-2025-71208, allows authenticated attackers to gain elevated access to protected resources.
A critical remote code execution vulnerability (CVE-2026-27794) in LangChain's LangGraph BaseCache class allows unauthenticated attackers to achieve code execution via deserialization of untrusted data.
A newly disclosed vulnerability in Trend Micro Apex One (CVE-2025-71213) allows local attackers to escalate privileges to SYSTEM via an origin validation error in the NT Listener service.
A time-of-check time-of-use vulnerability in Trend Micro Apex One's iCore service lets attackers with low-privileged code execution escalate to root, with a CVSS score of 7.8.
A critical unauthenticated remote code execution vulnerability in Music Assistant, CVE-2026-26975, was disclosed by ZDI after being demonstrated at Pwn2Own, allowing network-adjacent attackers to execute arbitrary code as root.
A link-following vulnerability in Trend Micro Cleaner One Pro (CVE-2025-71218) allows local attackers to create a denial-of-service condition via a symbolic link attack.
A high-severity vulnerability in Trend Micro Apex Central's management console allows authenticated attackers to escalate privileges, with a patch now available.