Vulnerabilities
Curated coverage and analysis in this editorial area.
ClamAV: The Guardian's Paradox — When the Antivirus Becomes an Attack Weapon
Trend Micro's Zero Day Initiative disclosed advisory ZDI-26-583 on August 13, 2026, detailing an integer overflow in ClamAV's 7z parse…
ZDI-26-573 Linux Kernel KSMBD Vulnerability Exposes Sensitive Information
An out-of-bounds read in init_smb2_rsp_hdr enables unauthenticated remote information disclosure on systems with KSMBD enabled.
CCleaner LPE to SYSTEM Bug: Patch Now, Maximum Risk on Shared Endpoints
The CVE-2026-12410 vulnerability in CCleaner's Uninstaller component allows local privilege escalation to SYSTEM via symlink. The patc…
Metabase Under Zero-Day Attack: Critical SQL Injection with CVSS 10.0 Exposes Entire Data Layers
The Metabase BI platform is under active zero-day exploitation via a critical SQL injection.
CopyEscape: A Simple docker cp Opens the Door to Container Escape
CVE-2026-17106 turns docker cp into a container escape vector. Discovered by Imperva, it allows a malicious container to overwrite fil…
Windows: win32kfull Driver Bug Allows Escalation to SYSTEM
Microsoft released a fix on August 11, 2026 for CVE-2026-62712, a vulnerability in the win32kfull driver that allows code running with…
Phoenix Contact CHARX SEC-3000: RCE as Root via Command Injection
CVE-2026-44095 in EV charging security appliances lets an authenticated, network-adjacent attacker execute arbitrary code as root.
Parallels RAS Client: Local Privilege Escalation to SYSTEM via Exposed Dangerous Function
ZDI advisory ZDI-26-556 discloses a local privilege escalation flaw in the Parallels RAS Client RAS RDP Backend Service. An attacker w…
Galaxy S25: RCE TIFF Flaw Patched in July, Disclosure Arrives in August
Trend Micro's Zero Day Initiative published advisory ZDI-26-529 on August 12, 2026, detailing a heap-based buffer overflow in the Sams…
CISA Confirms SharePoint Ransomware Exploitation; Microsoft Stays Silent
The U.S. cybersecurity agency confirmed on August 11, 2026, that ransomware groups are actively exploiting CVE-2026-45659 in on-premis…
Trend Cleaner One Pro: Cleanup Service Turned Weapon for Arbitrary File Deletion
ZDI-26-496 reveals a vulnerability in Cleaner One Pro's Junk Files Cleanup service that allows a local attacker to delete arbitrary fi…
Dirty Frag: Linux Kernel LPE Chain with Public PoC and Patches Available
Dirty Frag is a two-vulnerability chain in the Linux kernel that enables root escalation on nearly all distributions. Mainline patches…