16 results for “CVE”
IBM Research published Bugstone-E2E, a research-stage framework that mines CVE fixing commits into 1,033 executable detection rules across 56 CWE families. It points to a path for defenders as AI-driven discovery pushes vulnerability counts to record highs.
Keycloak CVE-2026-18963 lets unauthenticated attackers reset any user's password without the email verification link. The flaw carries a 9.1 CVSS score and affects every deployment using the default password reset flow.
Oasis Security researchers disclosed CVE-2026-65105 in NVIDIA NemoClaw: configuring host Ollama on 0.0.0.0:11434 for sandbox reachability disables a key Host-header defense, letting a malicious webpage reach the unauthenticated API via DNS rebinding and rewrite the model chat template. NVIDIA credited the finders in its August 2026 NemoClaw and OpenShell security bulletin.
Security researcher Hyunwoo Kim has disclosed Zapscape (CVE-2026-64561), a use-after-free vulnerability in the Linux kernel's KVM hypervisor that allows. Zapscape is the third entry in what Kim describes as a KVM escape trilogy, following.
CISA added CVE-2026-21962, an actively exploited Oracle WebLogic and HTTP Server access control flaw, to its Known Exploited Vulnerabilities Catalog on August 24. Federal agencies have until August 27 to remediate, setting a three-day benchmark for all organizations running exposed instances.
Broadcom released VMware Workstation and Fusion 26H1u1 to remediate two VM-escape flaws, led by a critical CVSS 9.3 integer overflow in VMXNET3. Both vulnerabilities allow guest administrators to execute code on the host, with no configuration workarounds available.
Security researcher Nightmare Eclipse released the ShieldBreak zero-day exploit for Microsoft Defender, claiming it bypasses the July patch for CVE-2026-50656. The flaw grants SYSTEM privileges on fully patched Windows 11 and Server 2025 when Defender is enabled.
On 29 July 2026, Broadcom published security advisory VMSA-2026-0006 addressing five vulnerabilities across VMware ESXi, vCenter Server, Workstation, and Fusion. vCenter Server is the central management plane for vSphere environments.
Trail of Bits tasked GPT-5.6-Cyber with escaping a QEMU/KVM VM on Debian 12. The agent broke out three times—using a disclosed kernel bug, unmarked libslirp fixes, and a self-found 0-day chain—showing off-the-shelf VMs no longer contain cyber-capable agents.
Meta is rolling out Pocket, its AI-powered vibe-coding app for creating and sharing interactive mini-games, to all U.S. users after a quiet test in Brazil. The launch extends Meta's push to make generative AI creation tools mainstream across standalone mobile apps.
Two dozen companies and organizations have signed an open letter urging United States policymakers to protect open-weight artificial intelligence models. The letter carves out space for one technique that has become contentious in AI.
CISA added seven actively exploited vulnerabilities to the KEV catalog, including flaws in LiteLLM, Kestra, SonicWall SMA 1000, JFrog Artifactory, and Sangoma Switchvox. Microsoft and Wiz report that AI infrastructure gateways are now active targets for reverse shells, crypto miners, and API key theft.