CVE-2026-85893 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-85893 Microsoft US
Výsledky hledání
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
· zachyceno
· zachyceno
CVE-2026-69486 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69486 Microsoft US
NCSC-2026-0369 [1.00] [M/H] Kwetsbaarheid verholpen in Palo Alto Networks PAN-OS
Palo Alto Networks heeft een kwetsbaarheid verholpen in PAN-OS software, specifiek voor VM-Series en PA-Series firewalls, evenals Panorama management software. De kwetsbaarheid betreft een buffer overflow in de XML-verwerkingsfunctionaliteit van PAN-OS. Ongeauthenticeerde aanvallers met netwerktoegang kunnen hierdoor een denial-of-service veroorzaken op VM-Series firewalls of willekeurige code uitvoeren met rootrechten op PA-Series firewalls. Ook Panorama management software is getroffen. De…
ALERTĂ: Vulnerabilitate exploatată activ în Cisco AsyncOS
DESCRIERE Experții în securitate cibernetică au descoperit o vulnerabilitate critică, CVE-...
Cisco RO
Vulnerabilità nel modulo CPython “tarfile”
Rilevata nuova vulnerabilità con gravità “alta” nel modulo “tarfile” incluso in CPython. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato, tramite archivi tar opportunamente predisposti, di accedere a informazioni sensibili e manipolare i dati sui sistemi interessati.
EPSS < 0.01 CVE-2026-82049 CPython IT
Sanata vulnerabilità in IBM Db2
Aggiornamenti di sicurezza IBM sanano una vulnerabilità, con gravità "alta", nel prodotto Db2, sistema di gestione di database relazionali (RDBMS). Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un attaccante remoto la scrittura di file arbitrari sui sistemi interessati.
EPSS 0.01 CVE-2026-15955 IBM IT
Vulnerabilità in prodotti GNU
Sanate 2 vulnerabilità di sicurezza con gravità "alta" nei prodotti GNU libextractor e GNU glibc, software open source del progetto GNU, utilizzati rispettivamente per l’estrazione di metadati da file e contenuti digitali, e per fornire le principali funzionalità della libreria standard C sui sistemi Linux. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eseguire codice arbitrario e compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.01 CVE-2026-19499 CVE-2026-91752 GNU IT
CISA: Critical VMware RCE flaw now exploited by ransomware gangs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]
CVE-2024-37079 * CVE-2025-22225 * CVE-2025-60710 * CVE-2026-22719 * CVE-2026-59310 * VMware US
· zachyceno
CareCam CM2507
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials. The following versions of CareCam CM2507 are affected: HMT.CM2507 Firmware v251211.1507 (CVE-2026-88259, CVE-2026-84398, CVE-2026-84400, CVE-2026-81305, CVE-2026-85478, CVE-2026-85497, CVE-2026-81321) CVSS Vendor Equipment Vulnerabilities v3…
EPSS 0.01 CVSS 7.5 CVE-2026-81305 CVE-2026-81321 CVE-2026-84398 CVE-2026-84400 CVE-2026-85478 CVE-2026-85497 CVE-2026-88259 CareCam US
· zachyceno
Siemens Reyrolle 7SR5
View CSAF Summary Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version. The following versions of Siemens Reyrolle 7SR5 are affected: Reyrolle 7SR5 vers:intdot/<2.70 (CVE-2024-42384, CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392, CVE-2026-62645, CVE-2026-62646, CVE-2026-62647, CVE-2026-62648, CVE-2026-62649, CVE-2026-62650, CVE-2026-62652, CVE-2026-62653,…
EPSS 0.01 CVSS 9.8 CVE-2024-42384 CVE-2024-42385 CVE-2024-42386 CVE-2024-42391 CVE-2024-42392 CVE-2026-62645 CVE-2026-62646 CVE-2026-62647 CVE-2026-62648 CVE-2026-62649 CVE-2026-62650 CVE-2026-62652 CVE-2026-62653 CVE-2026-62654 Siemens energetika US
· zachyceno
Wärtsilä FOS-Onboard
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized update, execute code, or extract credentials to allow the attacker to impersonate a privileged client. The following versions of Wärtsilä FOS-Onboard are affected: FOS-Onboard 5.07.0923.01 (CVE-2026-78225, CVE-2026-81855) CVSS Vendor Equipment Vulnerabilities v3 9.1 Wärtsilä Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key Background Critical Infrastructure Sectors:…
EPSS 0.01 CVSS 9.1 CVE-2026-78225 CVE-2026-81855 Wärtsilä doprava US
· zachyceno
SPOJENO PŘES CVE Siemens Mendix SAML
View CSAF Summary Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. The following versions of Siemens Mendix SAML are affected: Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.3 (CVE-2026-80465) Mendix SAML (Mendix 11 compatible) vers:intdot/<4.2.3 (CVE-2026-80465) Mendix SAML (Mendix 9.24…
EPSS < 0.01 CVSS 8.7 CVE-2026-80465 Siemens výroba a průmysl US IT
· zachyceno
Siemens Teamcenter
View CSAF Summary A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim's Teamcenter session. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following…
EPSS < 0.01 CVSS 6.1 CVE-2026-58113 Siemens výroba a průmysl US
· zachyceno
Schneider Electric SCADAPack x70 Products
View CSAF Summary Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration through the Secure Lock functionality, potentially resulting in a loss of confidentiality. The…
EPSS 0.01 CVSS 6.5 CVE-2026-81861 Schneider Electric výroba a průmysl energetika US
· zachyceno
mySCADA myPRO Manager
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS messages through the connected GSM modem. The following versions of mySCADA myPRO Manager are affected: mySCADA myPRO Manager <=2.1 (CVE-2026-73807, CVE-2026-82567) CVSS Vendor Equipment Vulnerabilities v3 9.8 mySCADA Technologies mySCADA myPRO Manager Missing Authorization, Missing Authentication for Critical Function Background Critical…
EPSS 0.01 CVSS 9.8 CVE-2026-73807 CVE-2026-82567 mySCADA Technologies výroba a průmysl energetika doprava vodárenství US
· zachyceno
Digital Watchdog VMAX DVR and NVR Product Lineups
View CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. The following versions of Digital Watchdog VMAX DVR and NVR Product Lineups are affected: VMAX A1 G4 DVRs vers:all/* (CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372) VMAX IP G4 NVRs vers:all/* …
EPSS 0.01 CVSS 9.6 CVE-2026-66372 CVE-2026-66887 CVE-2026-66890 CVE-2026-68070 CVE-2026-68950 CVE-2026-68953 Digital Watchdog veřejná správa zdravotnictví doprava US
· zachyceno
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.
média GB
· zachyceno
Iranian cyber targeting of dissidents, activists and journalists
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.
média GB
Rilevate vulnerabilità nel tema WordPress “Design Scuole Italia”
Rilevate quattro vulnerabilità, di cui due con gravità “alta”, in Design Scuole Italia, noto tema WordPress destinato alla realizzazione dei siti istituzionali delle scuole italiane. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di leggere file arbitrari sul filesystem, eludere i meccanismi di autenticazione ed accedere a informazioni sensibili sui sistemi interessati
EPSS 0.01 CVE-2026-87791 CVE-2026-87792 CVE-2026-87793 CVE-2026-89307 WordPress Design Scuole Italia školství IT
Trexom: aggiornamenti di sicurezza
Trexom ha rilasciato aggiornamenti di sicurezza per risolvere una vulnerabilità con gravità “alta” in TrxTimeATTENDANCE, noto software di rilevazione delle presenze. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.
EPSS 0.02 CVE-2026-89308 Trexom IT
Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]
CVE-2025-20393 * CVE-2026-20353 * CVE-2026-76440 * CVE-2026-76441 * CVE-2026-76443 * CVE-2026-76461 * Cisco US
· zachyceno
About the security content of iOS 27 and iPadOS 27
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-86882, CVE-2026-43664, CVE-2026-64761, CVE-2026-65404, CVE-2026-84523, CVE-2026-86888, CVE-2026-20683, CVE-2026-65408, CVE-2026-65407, CVE-2026-84519, CVE-2026-84593, CVE-2026-86905, CVE-2026-84583, CVE-2026-65410, CVE-2026-84616, CVE-2026-84607, CVE-2026-65406, CVE-2026-86885, CVE-2026-86879, CVE-2026-65414 (+253 other associated CVEs), Summary: This document describes the security…
Apple FI
· zachyceno
SPOJENO PŘES CVE Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443, Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally…
EPSS 0.02 CVSS 9.8 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco FI US
· zachyceno
SPOJENO PŘES CVE Vulnérabilité dans Microsoft Windows (15 septembre 2026)
Une vulnérabilité a été découverte dans Microsoft Windows. Elle permet à un attaquant de provoquer une élévation de privilèges.
EPSS < 0.01 CVE-2026-85921 Microsoft FR US
· zachyceno
Multiples vulnérabilités dans Microsoft Edge (15 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une élévation de privilèges et un problème de sécurité non spécifié par l'éditeur.
Microsoft FR
· zachyceno
Multiples vulnérabilités dans les produits Apple (15 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Apple FR
Apple Updates Everything, (Mon, Sep 14th)
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases. In addition to the major "27" version, Apple also released bug-fix-only releases for the 26 branch of its operating systems and for 15 (Sequioa) for macOS. None of the vulnerabilities is…
Apple US
NCSC-2026-0368 [1.00] [H/H] Kwetsbaarheid verholpen in Cisco Secure Email Gateway
Cisco heeft een kwetsbaarheid verholpen in Cisco Secure Email Gateway. De kwetsbaarheid bevindt zich in de verwerking van e-mailberichten binnen Cisco AsyncOS Software voor Cisco Secure Email Gateway en wordt veroorzaakt door onvoldoende validatie van inkomende e-mailberichten. Een niet-geauthenticeerde kwaadwillende kan een speciaal vervaardigd e-mailbericht met kwaadaardige SQL-instructies naar een kwetsbaar systeem versturen. Succesvol misbruik kan leiden tot het uitvoeren van willekeurige…
Cisco NL
Android security advisory – September 2026 monthly rollup (AV26-920)
Serial Number: AV26-920Date: September 14, 2026 As of September 8, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices. The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Android Security Bulletin—September 2026
Android CA
Samsung mobile security advisory (AV26-919)
Serial number: AV26-919Date: September 14, 2026 As of September 8, 2026, Samsung published a security update to address vulnerabilities in the following product: Samsung mobile devices – versions prior to SMR-SEP-2026 The most recent security update resolves multiple identified vulnerabilities. The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update. Samsung Security Updates
Samsung CA
MongoDB security advisory (AV26-918)
Serial number: AV26-918Date: September 14, 2026 As of September 11, 2026, MongoDB is affected by a vulnerability in the following product: MongoDB Server Prior to 7.0.43 Prior to 8.0.32 Prior to 8.3.11 Prior to 9.1.0-rc0 Prior to 9.0.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Shred collection validator constants during parsing Alerts | MongoDB
MongoDB CA
Vulnerabilities in Alior Bank "raty" module for PrestaShop
CERT Polska has received a report about 2 SQL Injection vulnerabilities (CVE-2026-7848 and CVE-2026-15600) found in Alior Bank "raty" module for PrestaShop.
EPSS < 0.01 CVE-2026-15600 CVE-2026-7848 PrestaShop Alior Bank PL
Risolta vulnerabilità in Parallels Desktop for Mac
Parallels ha rilasciato aggiornamenti di sicurezza che sanano una vulnerabilità con gravità "alta" in Parallels Desktop for Mac, software per l’esecuzione di macchine virtuali su sistemi Mac
EPSS < 0.01 CVE-2026-90894 Parallels IT
Risolta vulnerabilità in MISP
Risolta una vulnerabilità con gravità "alta" in MISP, piattaforma open source per la condivisione e l'analisi di informazioni sulle minacce informatiche
EPSS < 0.01 CVE-2026-90895 MISP IT
14th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1. Exposed data included names and government identification numbers, while a criminal marketplace advertised a collection containing millions of identity documents, including driver’s licenses, associated with the…
KEV ✓ EPSS 0.99 CVSS 10.0 CVE-2026-67276 CVE-2026-72898 CVE-2026-81963 CVE-2026-85046 CVE-2026-85706 CVE-2026-85880 CVE-2026-86060 Microsoft GitLab MikroTik Anthropic IL
Risolta vulnerabilità in MongoDB Server
Aggiornamenti di sicurezza sanano una vulnerabilità con gravità "alta" che interessa MongoDB Server, sistema di gestione di basi di dati documentali utilizzato per archiviare, gestire ed elaborare grandi quantità di informazioni. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato autenticato, con privilegi di lettura/scrittura sul database, di compromettere la disponibilità del servizio e manipolare i dati sui sistemi interessati.
EPSS < 0.01 CVE-2026-89099 MongoDB IT
Control de acceso inadecuado en la API REST de Hiperdino
Inadequate access control in the Hiperdino REST API Mon, 09/14/2026 - 13:27 Aviso Affected Resources Hiperdino REST API v1.0. Description INCIBE has coordinated the disclosure of a critical-severity vulnerability affecting the Hiperdino REST API, which acts as a bridge for carrying out actions automatically and in real time. The vulnerability was discovered by Jorge Ramos Santana.This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability…
EPSS 0.01 CVSS 9.2 CVE-2026-12258 Hiperdino obchod ES
JFrog: rilevato sfruttamento in rete delle vulnerabilità CVE-2026-42016 e CVE-2026-42018 in Artifactory
Rilevato lo sfruttamento attivo in rete di due vulnerabilità con gravità "alta" - già sanate dal vendor - relative al prodotto JFrog Artifactory, piattaforma per la gestione e distribuzione di artefatti software
KEV ✓ EPSS 0.10 CVE-2026-42016 CVE-2026-42018 JFrog IT
SPOJENO PŘES CVE Rilevato sfruttamento della CVE-2026-84869 relativa al prodotto ConnectWise ScreenConnect
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-84869 con gravità "critica" - già sanata dal vendor - relativa al prodotto ConnectWise ScreenConnect
KEV ✓ EPSS 0.01 CVE-2026-84869 ConnectWise IT US CA
CISA: Hackers now exploit max severity GitLab flaw in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks. [...]
CVE-2021-22175 * CVE-2021-39935 * CVE-2026-85706 * GitLab US
· zachyceno
ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-31719.
EPSS < 0.01 CVSS 8.8 CVE-2026-31719 Linux US
· zachyceno
ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-64265.
EPSS < 0.01 CVSS 7.8 CVE-2026-64265 Linux US
· zachyceno
ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-43040.
EPSS < 0.01 CVSS 6.0 CVE-2026-43040 Linux US
· zachyceno
ZDI-26-683: Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-72463.
EPSS < 0.01 CVSS 7.5 CVE-2026-72463 Linux US
· zachyceno
ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0. The following CVEs are assigned: CVE-2026-64397.
EPSS < 0.01 CVSS 9.0 CVE-2026-64397 Linux US
· zachyceno
ZDI-26-685: Linux Kernel NFC NCI UART Driver Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-38416.
EPSS < 0.01 CVSS 8.8 CVE-2025-38416 Linux US
· zachyceno
ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-74565.
EPSS < 0.01 CVSS 7.8 CVE-2026-74565 Linux US
· zachyceno
ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.4. The following CVEs are assigned: CVE-2026-80994.
EPSS < 0.01 CVSS 6.4 CVE-2026-80994 Linux US
· zachyceno
ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-74465.
EPSS < 0.01 CVSS 7.8 CVE-2026-74465 Linux US
· zachyceno
ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.4. The following CVEs are assigned: CVE-2026-46227.
EPSS < 0.01 CVSS 6.4 CVE-2026-46227 Linux US
· zachyceno
ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-45930.
EPSS < 0.01 CVSS 6.0 CVE-2026-45930 Linux US
· zachyceno
ZDI-26-691: Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-53182.
EPSS < 0.01 CVSS 8.2 CVE-2026-53182 Linux US
· zachyceno
ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-31583.
EPSS < 0.01 CVSS 7.1 CVE-2026-31583 Linux US
· zachyceno
ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. Furthermore, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 8.5.
CVSS 8.5 Linux US
· zachyceno
ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-23413.
EPSS < 0.01 CVSS 8.2 CVE-2026-23413 Linux US
· zachyceno
ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. Furthermore, only systems with nfsd enabled are vulnerable. The ZDI has assigned a CVSS rating of 8.5. The following CVEs are assigned: CVE-2026-89688.
EPSS 0.01 CVSS 8.5 CVE-2026-89688 Linux US
· zachyceno
ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability
This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-72196.
EPSS < 0.01 CVSS 8.8 CVE-2026-72196 Linux US
· zachyceno
ZDI-26-697: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3.
CVSS 7.3 Linux US
· zachyceno
ZDI-26-698: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.2.
CVSS 5.2 Linux US
· zachyceno
ZDI-26-699: Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.2.
CVSS 5.2 Linux US