Threats tagged 'remote'

A numeric truncation error vulnerability in Valkey's clusterCreatePublishMsgBlock function allows remote authenticated attackers to execute arbitrary code. The vulnerability requires authentication and has been rated with a high severity score by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics due to unsafe deserialization in the torch_load function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118613 and a CVSS rating of 7.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics' check_det_dataset component, allowing attackers to execute arbitrary code if a user interacts with malicious content. The vulnerability requires user interaction such as visiting a malicious page or opening a malicious file. It has been assigned CVE-2026-118614 and a CVSS rating of 7.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics due to a command injection flaw in the torch_safe_load function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118615 and a high severity rating by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics' parse_model component that allows attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118616 and a CVSS rating of 7.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics due to unsafe deserialization in the load_dataset_cache_file function. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI and is tracked as CVE-2026-118617.

A remote code execution vulnerability exists in Ultralytics' parse_model functionality. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2026-118618 with a high severity rating by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics related to Google Drive download path traversal. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability is assigned CVE-2026-118619 with a high severity rating by ZDI.

A remote code execution vulnerability exists in Alpine iLX-F511 devices due to hard-coded SSH credentials. This flaw allows network-adjacent attackers to execute arbitrary code without authentication. The vulnerability has a CVSS rating of 6.3 and is tracked as CVE-2026-118601.

A stack-based buffer overflow vulnerability exists in the vCard parsing functionality of Alpine iLX-F511 devices. Exploitation requires the target device to connect to a malicious Bluetooth device, enabling network-adjacent attackers to execute arbitrary code remotely. The vulnerability has been assigned CVE-2026-118603 and a CVSS rating of 8.0 by the Zero Day Initiative.

A stack-based buffer overflow vulnerability in the Alpine iLX-F511 Framework Service allows physically present attackers to execute arbitrary code without authentication. The vulnerability has a medium severity rating and is tracked as CVE-2026-118604.

A stack-based buffer overflow vulnerability exists in the prh_sdp_service_search_decode function of Alpine iLX-F511 devices. This flaw allows network-adjacent attackers who can pair a malicious Bluetooth device with the target to execute arbitrary code remotely. The vulnerability is assigned CVE-2026-118605 and has a high severity rating with a CVSS score of 8.0 by the Zero Day Initiative.

A remote code execution vulnerability exists in the Alpine iLX-F511 Framework Service that can be exploited by network-adjacent attackers without authentication. This vulnerability allows arbitrary code execution on affected devices and has been assigned CVE-2026-118606 with a high severity rating by the Zero Day Initiative.

A stack-based buffer overflow vulnerability exists in the Alpine iLX-F511 Android Auto Connection Handler that allows physically present attackers to execute arbitrary code without authentication. The vulnerability has a medium severity rating with a CVSS score of 6.8 assigned by ZDI. No affected software versions or patch information are provided.

A stack-based buffer overflow vulnerability in the Android Auto Service of Alpine iLX-F511 devices allows network-adjacent attackers to execute arbitrary code without authentication. This vulnerability has been assigned CVE-2026-118610 and a CVSS rating of 8.8, indicating high severity.

A heap-based buffer overflow vulnerability exists in the Bluetooth OBEX packet handling of Alpine iLX-F511 devices. This flaw allows attackers with physical proximity to execute arbitrary code without requiring authentication. The vulnerability is tracked as CVE-2026-118611 and has a CVSS rating of 6.8, indicating a medium severity level.

HPE has released patches addressing 72 vulnerabilities in its Aruba networking products' AOS-8 and AOS-10 wireless operating systems, including eight maximum-severity flaws that could allow unauthenticated remote code execution and authentication bypass. These vulnerabilities affect various hardware and virtual machines compatible with these operating systems. HPE recommends restricting management interfaces and applying patches promptly. No exploitation in the wild has been reported.

This analysis discusses how AI is expanding the attack surface of critical infrastructure managed by state, local, and education (SLED) agencies. Cyber attackers often target under-resourced SLED organizations operating critical infrastructure such as water systems, hospitals, and emergency services. AI adoption by these agencies and adversaries' use of AI automation complicate security efforts. A whole-of-state cybersecurity approach, treating all local entities as a unified defensive perimeter, is recommended to mitigate risks. The report highlights concerns about aging operational technology, limited cyber staff in small communities, and unclear governance responsibilities. Attacks on smaller entities can have cascading effects on larger systems and public safety. Insider threats and excessive access privileges further increase risk. Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern.

CVE-2026-111497, known as Brotli2Shell, is a critical out-of-bounds write vulnerability in Google's Brotli C decoder library. It affects many widely used software projects that decompress Brotli data, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse, and PHP for Windows. The flaw can be triggered by decompressing crafted Brotli data, potentially leading to process crashes, memory leaks, or remote code execution. The vulnerability has a high CVSSv4.0 score of 9.2 assigned by Google. Patches have been released for the Brotli library and major runtimes, but some projects had not shipped fixed releases as of late October 2026. Applications bundling their own Brotli decoder require individual updates.

Two new vulnerabilities affecting specific Intel processors have been identified. CVE-2025-21090 allows an unprivileged actor using the AMX and AVX CPU instructions to render the host machine inoperative. CVE-2025-22840 allows an unprivileged actor using the prefetchit CPU instruction to access memory contents without authorization, potentially leading to remote code execution. Google has stated no customer action is required as they will update systems during planned maintenance windows. No evidence of exploitation has been reported.