Vulnerabilities
Curated coverage and analysis in this editorial area.
City Relay Hit by Double Metabase Breach Exposing Financial Data and Lockbox Codes
London property manager City Relay disclosed two separate compromises of its Metabase Cloud instance, potentially exposing bank detail…
NoMachine Redis: Insufficient Entropy Opens Local Privilege Escalation
ZDI-26-711 reveals a flaw in NoMachine's Redis authentication mechanism. Patched versions 10.1.7, 9.9.6, and 8.27.1 resolve the LPE ri…
ZDI Discloses Zero-Day in BusyBox: Symlink Directory Traversal Enables Arbitrary File Creation
Trend Micro's Zero Day Initiative published advisory ZDI-26-705 on September 17, 2026, detailing a zero-day vulnerability in the BusyB…
NoMachine Critical mDNS Flaw: Unauthenticated RCE on Local Networks. Patch Now
The Trend Micro Zero Day Initiative published advisory ZDI-26-710 on September 16, 2026, detailing a heap-based buffer overflow in NoM…
CVE-2026-89026: Hard-Coded JWT Key Enables RCE on Issabel PBX
A hard-coded cryptographic key in the Issabel Framework allows unauthenticated remote code execution on PBX phone systems. The Shadows…
Acronis Patches CVE-2026-87886: In-the-Wild Exploit in cPanel Plugin
Acronis has released urgent patches for CVE-2026-87886, a local privilege escalation vulnerability with a CVSS 7.8 score that is alrea…
Active Exploits Target WooCommerce Wholesale Lead Capture Plugin: The Patch Gap
Threat actors are exploiting CVE-2026-27540 in the WordPress WooCommerce Wholesale Lead Capture plugin. A patch has existed since Febr…
CVE-2026-46300 Fragnesia: Linux Kernel Bug Exposed on GKE Since May
Fragnesia exploits a flaw in skb_try_coalesce() to corrupt the page cache and gain root. Disclosed May 13, with public PoC and patch i…
CVE-2026-89688: Linux Kernel RCE, a Patch Written with Help from Claude
Trend Micro's Zero Day Initiative disclosed ZDI-26-695, a critical remote code execution flaw in the Linux kernel's NFSv4 server with…
GitLab Patches CVE-2026-85706: Path Traversal CVSS 10.0 in Self-Managed Instances
GitLab released critical patches on September 10 for CVE-2026-85706, a path traversal vulnerability with a CVSS 10.0 score that expose…
Adobe Photoshop: RCE via DICOM JPEG (CVE-2026-75862) Patched in APSB26-130
An integer overflow in Adobe Photoshop's DICOM JPEG parser enables remote code execution. CVE-2026-75862 carries a CVSS 7.8 rating and…
Azure Entra ID: OAuth Device Code Grant Flaw Exposes Arbitrary Tenant Data
ZDI advisory ZDI-26-629 discloses a pre-disclosure vulnerability in the Azure Entra ID OAuth Device Code Grant endpoint. Unauthenticat…