<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <atom:link href="https://www.zerodayinitiative.com/rss/published/" rel="self" type="application/xml" />
    <title><![CDATA[ZDI: Published Advisories]]></title>
    <link>http://www.zerodayinitiative.com/advisories/published/</link>
    <description><![CDATA[The following is a list of publicly disclosed vulnerabilities discovered by
                   Zero Day Initiative researchers. While the affected vendor is working on a patch for these
                   vulnerabilities, TrendAI customers are protected from exploitation by security filters
                   delivered ahead of public disclosure. All security vulnerabilities that are acquired by the
                   Zero Day Initiative are handled according to the ZDI Disclosure Policy.
        ]]></description>
    <pubDate>Fri, 06 Mar 2026 23:56:07 -0600</pubDate>
    <copyright>Trend Micro, all rights reserved</copyright>
    <language>en</language>
    
    <item>
      <title><![CDATA[ZDI-26-170: GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28911</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-170/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-3086.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-169: GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28910</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-169/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-3084.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-168: GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28854</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-168/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2921.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-167: GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28851</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-167/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3085.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-166: GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28850</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-166/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3083.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-165: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28845</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-165/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2922.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-164: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28843</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-164/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2920.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-163: GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28840</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-163/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-3082.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-162: GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28839</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-162/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-3081.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-161: GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28838</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-161/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2923.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-160: (Pwn2Own) Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28480</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-160/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-3562.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-159: (Pwn2Own) Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28479</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-159/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-3561.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-158: (Pwn2Own) Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28469</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-158/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3560.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-157: (Pwn2Own) Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28451</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-157/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-3559.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-156: (Pwn2Own) Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28374</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-156/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-3558.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-155: (Pwn2Own) Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28337</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-155/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-3557.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-154: (Pwn2Own) Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28326</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-154/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3556.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-153: (Pwn2Own) Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28276</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-153/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-3555.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-152: Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28304</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-152/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-15558.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-151: Delta Electronics CNCSoft-G2 DPAX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28415</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-151/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-3094.]]></description>
      <pubDate>Fri, 06 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-150: Docker Desktop for Mac Docker Model Runner Exposed Dangerous Function Denial-of-Service Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28379</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-150/</link>
      <description><![CDATA[This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-28400.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-149: Trend Micro Cleaner One Pro Link Following Denial-of-Service Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28218</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-149/</link>
      <description><![CDATA[This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Trend Micro Cleaner One Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.0. The following CVEs are assigned: CVE-2025-71218.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-148: Trend Micro Apex Central Improper Authentication Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26039</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-148/</link>
      <description><![CDATA[This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2025-71209.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-147: Trend Micro Apex Central Improper Authentication Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26037</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-147/</link>
      <description><![CDATA[This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2025-71208.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-146: Trend Micro Apex Central Manual Update Server-Side Request Forgery Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26597</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-146/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The following CVEs are assigned: CVE-2025-71207.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-145: Trend Micro Apex Central Scheduled Update Server-Side Request Forgery Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26598</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-145/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The following CVEs are assigned: CVE-2025-71206.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-144: Trend Micro Apex Central Hub Server Server-Side Request Forgery Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26618</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-144/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The following CVEs are assigned: CVE-2025-71205.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-143: Trend Micro Apex One Security Agent TmSelfProtect Origin Validation Error Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26594</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-143/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71217.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-142: Trend Micro Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26605</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-142/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71216.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-141: Trend Micro Apex One Security Agent iCore Service Signature Verification Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26609</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-141/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71215.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-140: Trend Micro Apex One Origin Validation Error Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26771</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-140/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71213.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-139: Trend Micro Apex One Security Agent iCore Service Origin Validation Error Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26282</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-139/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71214.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-138: Trend Micro Apex One Virus Scan Engine Link Following Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-24972</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-138/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71212.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-137: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28002</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-137/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-71211.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-136: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28001</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-136/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-71210.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-135: LangChain LangGraph BaseCache Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28385</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-135/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of LangChain LangGraph. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-27794.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-134: Hewlett Packard Enterprise AutoPass License Server Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27634</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-134/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-23600.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-133: (Pwn2Own) Music Assistant _update_library_item External Control of File Path Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28235</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-133/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Music Assistant. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-26975.]]></description>
      <pubDate>Tue, 03 Mar 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-132: Siemens SINEC NMS Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28108</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-132/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Siemens SINEC NMS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-25656.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-131: Siemens SINEC NMS Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28107</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-131/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Siemens SINEC NMS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-25655.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-130: IceWarp collaboration Directory Traversal Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-25440</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-130/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-2493.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-129: Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-23993</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-129/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Socomec DIRIS A-40 power monitoring devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-2491.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-128: (Pwn2Own) Ubiquiti Networks AI Pro Uncaught Exception Denial-of-Service Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28824</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-128/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Ubiquiti Networks AI Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-21634.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-127: (Pwn2Own) Ubiquiti Networks AI Pro Cleartext Transmission Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28474</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-127/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Ubiquiti Networks AI Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-21633.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-126: (Pwn2Own) Ubiquiti Networks AI Pro Discovery Protocol Missing Encryption Protocol Downgrade Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28274</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-126/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to downgrade the communication protocol on affected installations of Ubiquiti Networks AI Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-21633.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-125: Docker Desktop grpcfuse Kernel Module Out-Of-Bounds Read Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28631</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-125/</link>
      <description><![CDATA[This vulnerability allows local attackers to disclose sensitive information on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-2664.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-124: claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27785</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-124/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-15060.]]></description>
      <pubDate>Wed, 25 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-123: Docker Desktop MCP Server Cleartext Storage of Sensitive Information Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27562</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-123/</link>
      <description><![CDATA[This vulnerability allows local attackers to disclose sensitive information on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5.]]></description>
      <pubDate>Mon, 23 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-122: PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27788</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-122/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-2040.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-121: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28591</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-121/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2048.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-120: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28530</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-120/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2047.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-119: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28265</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-119/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2045.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-118: GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28158</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-118/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2044.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-117: RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27909</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-117/</link>
      <description><![CDATA[This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2026-2490.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-116: TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-25480</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-116/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-2492.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-115: Fortinet FortiClient VPN FCConfig Utility Link Following Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-25710</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-115/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Fortinet FortiClient VPN. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-62676.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-114: Dassault Systèmes eDrawings Viewer EPRT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28404</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-114/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-1335.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-113: Dassault Systèmes eDrawings Viewer EPRT File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28378</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-113/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-1334.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-112: Dassault Systèmes eDrawings Viewer EPRT File Parsing Uninitialized Variable Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28315</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-112/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-1333.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-111: MLflow Use of Default Password Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28256</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-111/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-2635.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-110: Bosch Rexroth IndraWorks Print Settings File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28112</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-110/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-60037,  CVE-2025-60038.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-109: Bosch Rexroth IndraWorks OPC.TestClient XML File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27994</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-109/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-60035.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-108: Bosch Rexroth IndraWorks UA.TestClient XML File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27996</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-108/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-60036.]]></description>
      <pubDate>Thu, 19 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-107: Autodesk AutoCAD MODEL File Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28581</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-107/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0875.]]></description>
      <pubDate>Wed, 18 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-106: Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28417</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-106/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0874.]]></description>
      <pubDate>Wed, 18 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-105: MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26649</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-105/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-2033.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-104: Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28129</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-104/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2034.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-103: Oracle VirtualBox VMSVGA Out-Of-Bounds Access Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27923</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-103/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-21956.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-102: Oracle VirtualBox VMSVGA Out-Of-Bounds Write Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27938</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-102/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-21957.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-101: Oracle VirtualBox BusLogic Uninitialized Memory Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28080</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-101/</link>
      <description><![CDATA[This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-21963.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-100: Oracle VirtualBox LsiLogic Uninitialized Memory Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28079</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-100/</link>
      <description><![CDATA[This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-21985.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-099: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27925</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-099/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-21984.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-098: Oracle VirtualBox VMSVGA Use-After-Free Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27870</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-098/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-21955.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-097: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28045</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-097/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-21983.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-096: Dassault Systèmes eDrawings Viewer EPRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28186</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-096/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-1283.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-095: Dassault Systèmes eDrawings Viewer EPRT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28188</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-095/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-1284.]]></description>
      <pubDate>Fri, 13 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-094: Schneider Electric EcoStruxure Power Build SSD File Parsing Use-After-Free Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27478</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-094/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-093: Schneider Electric EcoStruxure Power Build SSD File Parsing Use-After-Free Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27480</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-093/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-092: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27455</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-092/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-091: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27362</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-091/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-090: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27364</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-090/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-089: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27374</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-089/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-088: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27390</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-088/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-087: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27363</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-087/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-086: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27370</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-086/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-085: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27368</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-085/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-084: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27371</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-084/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-083: Microsoft Windows searchConnector-ms NTLM Response Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28491</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-083/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose NTLM responses on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-21249.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-082: Microsoft Exchange InterceptorSmtpAgent Reliance on Untrusted Inputs Security Feature Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28410</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-082/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass a security feature on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-21527.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-081: Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28066</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-081/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-21235.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-080: Ivanti Endpoint Manager AuthHelper Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26885</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-080/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.6. The following CVEs are assigned: CVE-2026-1603.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-079: Ivanti Endpoint Manager ROI SQL Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26863</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-079/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-1602.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-078: Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28131</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-078/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deciso OPNsense. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-2035.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-077: GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28597</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-077/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-2039.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-076: GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27936</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-076/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-2036.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-075: GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27934</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-075/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-2038.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-074: GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27935</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-074/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-2037.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-073: Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28250</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-073/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-2041.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-072: Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28249</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-072/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-2043.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-071: Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28245</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-071/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-2042.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-070: Adobe ColdFusion CAR File Parsing Directory Traversal Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27940</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-070/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe ColdFusion. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2025-61808.]]></description>
      <pubDate>Fri, 06 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-069: (0Day) Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26034</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-069/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0777.]]></description>
      <pubDate>Fri, 06 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-068: Docker Desktop for Windows Incorrect Permission Assignment Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28542</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-068/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. User interaction on the part of an administrator is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.7. The following CVEs are assigned: CVE-2025-14740.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-067: Docker Desktop for Windows Incorrect Permission Assignment Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28190</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-067/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. User interaction on the part of an administrator is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.7. The following CVEs are assigned: CVE-2025-14740.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-066: (Pwn2Own) Lexmark CX532adwe getCFFNames Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28333</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-066/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65079.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-065: (Pwn2Own) Lexmark CX532adwe usecmap Type Confusion Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28328</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-065/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65080.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-064: (Pwn2Own) Lexmark CX532adwe execuserobject Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28341</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-064/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65081.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-063: (Pwn2Own) Lexmark CX532adwe libesffls Directory Traversal Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28261</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-063/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65077.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-062: (Pwn2Own) Lexmark CX532adwe esfhelper Untrusted Search Path Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28477</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-062/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Lexmark CX532adwe printers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-65078.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-061: NVIDIA Triton Inference Server EVBufferToJson Uncaught Exception Denial-of-Service Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26889</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-061/</link>
      <description><![CDATA[This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of NVIDIA Triton Inference Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2025-33201.]]></description>
      <pubDate>Wed, 04 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-060: NVIDIA Megatron-LM load_base_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27989</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-060/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron-LM. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-24149.]]></description>
      <pubDate>Wed, 04 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-059: CyberArk Endpoint Privilege Management Improper Privilege Management Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26000</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-059/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of CyberArk Endpoint Privilege Management. An attacker must first obtain a low-privileged interactive user session on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2025-66374.]]></description>
      <pubDate>Tue, 03 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-058: AzeoTech DAQFactory Pro CTL File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27641</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-058/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-66589.]]></description>
      <pubDate>Tue, 03 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-057: Apple Safari JavaScriptCore FTL New Array Materialization Type Confusion Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28285</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-057/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-46298.]]></description>
      <pubDate>Tue, 03 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-056: Apple macOS AppleIntelKBLGraphics Out-Of-Bounds Read Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28035</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-056/</link>
      <description><![CDATA[This vulnerability allows local attackers to disclose sensitive information on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2025-43283.]]></description>
      <pubDate>Tue, 03 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-055: Progress Software Kemp LoadMaster addapikey Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27596</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-055/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.4. The following CVEs are assigned: CVE-2025-13447.]]></description>
      <pubDate>Mon, 02 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-054: Progress Software Kemp LoadMaster delapikey OS Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27595</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-054/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of 	Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2025-13447.]]></description>
      <pubDate>Mon, 02 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-053: Progress Software Kemp LoadMaster listapikeys Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27591</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-053/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.4. The following CVEs are assigned: CVE-2025-13447.]]></description>
      <pubDate>Mon, 02 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-052: Progress Software Kemp LoadMaster getcipherset Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27593</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-052/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2025-13444.]]></description>
      <pubDate>Mon, 02 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-051: Progress Software Kemp LoadMaster delcert Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27594</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-051/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of 	Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2025-13447.]]></description>
      <pubDate>Mon, 02 Feb 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-050: GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28599</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-050/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0797.]]></description>
      <pubDate>Fri, 30 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-049: Delta Electronics DIAView Exposed Dangerous Method Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27093</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-049/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DIAView. User interaction is required to exploit this vulnerability in that the target must open and run a malicious project. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0975.]]></description>
      <pubDate>Wed, 28 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-048: Fortinet FortiSandbox fortisandbox Server-Side Request Forgery Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27307</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-048/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-67685.]]></description>
      <pubDate>Wed, 28 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-047: Hancom Office DOC File Parsing Type Confusion Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26620</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-047/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hancom Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-29867.]]></description>
      <pubDate>Wed, 28 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-046: Cisco Snort _bnfa_search_csparse_nfa Use-After-Free Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27892</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-046/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-20026.]]></description>
      <pubDate>Wed, 28 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-045: Cisco Snort _bnfa_search_csparse_nfa Out-Of-Bounds Read Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27893</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-045/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-20027.]]></description>
      <pubDate>Wed, 28 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-044: Microsoft Windows Desktop Window Manager Use-After-Free Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28082</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-044/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-20871.]]></description>
      <pubDate>Tue, 13 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-043: (0Day) npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-25430</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-043/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0775.]]></description>
      <pubDate>Mon, 12 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-042: (0Day) Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26845</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-042/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0773.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-041: (0Day) (Pwn2Own) Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-23285</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-041/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Enel X JuiceBox 40 charging stations. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-0778.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-040: (0Day) Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27057</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-040/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-0776.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-039: (0Day) WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26708</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-039/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchYourLAN. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-0774.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-038: (0Day) Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27919</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-038/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-0772.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-037: (0Day) Langflow PythonFunction Code Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27497</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-037/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-0771.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-036: (0Day) Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27325</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-036/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0770.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-035: (0Day) Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-26972</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-035/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0769.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-034: (0Day) Langflow code Code Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27322</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-034/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0768.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-033: (0Day) Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28259</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-033/</link>
      <description><![CDATA[This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-0767.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-032: (0Day) Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28257</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-032/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-0766.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-031: (0Day) Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28258</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-031/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-0765.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-030: (0Day) GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27957</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-030/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0764.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-029: (0Day) GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27958</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-029/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0763.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-028: (0Day) GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27956</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-028/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-0762.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-027: (0Day) Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28124</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-027/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0761.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-026: (0Day) Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28121</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-026/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0760.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-025: (0Day) Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27786</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-025/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Katana Network Development Starter Kit. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0759.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-024: (0Day) mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27910</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-024/</link>
      <description><![CDATA[This vulnerability allows local attackers to escalate privileges on affected installations of mcp-server-siri-shortcuts. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0758.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-023: (0Day) MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27810</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-023/</link>
      <description><![CDATA[This vulnerability allows remote attackers to bypass the sandbox on affected installations of MCP Manager for Claude Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-0757.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-022: (0Day) github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27784</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-022/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0756.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-021: (0Day) gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27783</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-021/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-0755.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-020: (0Day) Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27683</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-020/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-15063.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-019: Cisco Identity Services Engine getSpecificPLRfromAuthCode XML External Entity Processing Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-27889</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-019/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20029.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-018: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28322</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-018/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0796.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-017: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28321</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-017/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0795.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-016: (0Day) ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28303</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-016/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-0794.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-015: (0Day) ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28302</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-015/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-0793.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-014: (0Day) ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28301</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-014/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-0792.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-013: (0Day) ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28300</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-013/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-0791.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-012: (0Day) ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28299</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-012/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-0790.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-011: (0Day) ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28297</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-011/</link>
      <description><![CDATA[This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-0789.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-010: (0Day) ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28298</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-010/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute web requests with a target user&#x27;s privileges on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-0788.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-009: (0Day) ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28296</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-009/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-0787.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-008: (0Day) ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28295</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-008/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-0786.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-007: (0Day) ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28294</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-007/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-0785.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-006: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28293</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-006/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0784.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-005: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28292</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-005/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0783.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-004: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28291</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-004/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0782.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-003: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28290</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-003/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0781.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-002: (0Day) ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-28289</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-002/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0780.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
    <item>
      <title><![CDATA[ZDI-26-001: (0Day) ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability]]></title>
      <guid isPermaLink="false">ZDI-CAN-25568</guid>
      <link>http://www.zerodayinitiative.com/advisories/ZDI-26-001/</link>
      <description><![CDATA[This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-0779.]]></description>
      <pubDate>Fri, 09 Jan 2026 00:00:00 -0600</pubDate>
    </item>
    
  </channel>
</rss>
