Vulnerabilities
Curated coverage and analysis in this editorial area.
X.Org Server UAF CVE-2026-34001: Local Root Escalation on Linux
ZDI-26-335 discloses a use-after-free in X.Org Server's SyncTriggerList: CVSS 7.8, local attack with no user interaction, X.Org patch…
CISA Adds Joomla JCE to KEV: Pre-Auth RCE, CVSS 10.0
CISA added CVE-2026-48907 to the Known Exploited Vulnerabilities catalog on June 16, 2026, confirming active exploitation of a pre-aut…
Vertex AI SDK: Cross-Tenant Bucket Squatting Enabled RCE
Google Cloud Vertex AI SDK versions 1.139.0 through 1.140.0 were vulnerable to cross-tenant bucket squatting leading to remote code ex…
LiteSpeed cPanel: Two CVEs Added to KEV Catalog, Shared Hosting at Risk
CISA adds two distinct LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog: root privilege escalation on shar…
ZDI-26-358: XSS in Allegra with a Classification Anomaly
Trend Micro's Zero Day Initiative published advisory ZDI-26-358 detailing an XSS flaw in Allegra's downloadAttachment method. The advi…
Langflow CVE-2026-5027: RCE Under Active Exploitation with 7,000 Instances Exposed
A critical path traversal vulnerability in Langflow is being exploited in the wild. CVE-2026-5027 (CVSS 8.8) enables unauthenticated r…
NVIDIA Transformers4Rec Flaw Enables RCE via Malicious ML Models
NVIDIA has patched a high-severity deserialization vulnerability (CVE-2026-24162, CVSS 7.8) in its Transformers4Rec library that allow…
CVE-2026-11645: Google Patches Fifth Chrome Zero-Day of 2026
Google has released a critical patch for CVE-2026-11645, a zero-day vulnerability in Chrome's V8 engine. With an exploit active in the…
ASUS MyASUS: SYSTEM Privilege Escalation Disclosed After 98 Days, Patch Link Remains Circular
CVE-2026-7480: A local privilege escalation vulnerability in MyASUS allows attackers to gain SYSTEM rights. While ASUS has issued an u…
RoguePlanet: Zero-Day Exploit (CVE-2026-42897) Hits Fully Patched Windows 10 and 11 Systems
RoguePlanet (CVE-2026-42897) leverages a race condition in Microsoft Defender to gain SYSTEM privileges on Windows 10 and 11 devices,…
ZDI-26-337: X.Org Server Vulnerability Enables Root Escalation on Linux
CVE-2026-34003 identifies a buffer overflow in the X.Org Server's CheckKeyTypes() function, allowing local privilege escalation to roo…
Kemp LoadMaster: Critical Pre-Auth RCE (CVSS 9.8) Triggers Urgent Patching
Progress Software has released a critical patch for Kemp LoadMaster following the coordinated disclosure of three pre-authentication R…