Výsledky hledání

ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92208.

CVSS 8.8 CVE-2026-92208 NoMachine US

tg: zranitelnost

16. 9. 07:00 · Zero Day Initiative · ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92209.

CVSS 7.8 CVE-2026-92209 NoMachine US

tg: zranitelnost

16. 9. 07:00 · Zero Day Initiative · ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-92210.

CVSS 7.2 CVE-2026-92210 NoMachine US

tg: zranitelnost

16. 9. 07:00 · Zero Day Initiative · ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability

SPOJENO PŘES CVE NoMachine: Possible escalation of privileges by impersonating the nx user

Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-18264, Summary: The following problem has been reported by ZeroDayInitiative (ZDI-26-483). A logged user could exploit the nx user via some server handlers to gain privileges for executing arbitrary operations. This issue affected NoMachine v9 and v8. It is now fixed in v9.8.2

EPSS 0.01 CVSS 8.8 CVE-2026-18264 NoMachine FI US

21. 8. 04:00 · NCSC-FI · NoMachine: Possible escalation of privileges by impersonating the nx user 29. 7. 07:00 · Zero Day Initiative · ZDI-26-483: NoMachine getstat Command Injection Remote Code Execution Vulnerability