145585 matches found
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Introduction In June 2026, as part of our Kaspersky Threat Intelligence Reporting service, we published extensive research on Project CAV3RN, a sophisticated modular framework used for cyberespionage activity against targets in Israel. We have been tracking this cluster since December 2025, and i...
dotnet: .NET Framework: Denial of Service via network-based buffer overflow
A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service DoS, making the affected system unavailable to legitimate users...
HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named the malware HollowGraph , says the approach...
NFSD: Fix SECINFO_NO_NAME decode error cleanup
...
mac802154: llsec: add skb_cow_data() before in-place crypto
...
pNFS: Fix use-after-free in pnfs_update_layout()
...
keys: Pin request_key_auth payload in instantiate paths
...
KEYS: fix overflow in keyctl_pkey_params_get_2()
...
nfsd: fix posix_acl leak on SETACL decode failure
...
hdlc_ppp: sync per-proto timers before freeing hdlc state
...
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass
A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...
Vulnerabilities of Microsoft Office, Excel, and 365 Apps for Enterprise packages, as well as Microsoft Office Online Server, allow attackers to disclose protected information.
The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise programs, as well as Microsoft Office Online Server, is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by...
VulnCheck KEV: CVE-2026-50522
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...
NGINX Map directive and Regex matching vulnerability
...
Excon: redact additional sensitive/risky headers when following redirects
...
Squid: Memory corruption in cache_digest reply handling
...
Squid: Memory disclosure in FTP gateway
...
Chromium: CVE-2026-15900 Use after free in GPU
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-15899 Use after free in CameraCapture
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
