Articles

Avast Premium Security Driver Vulnerability Enables Local Privilege Escalation

CVE-2026-5424, a flaw in Avast Premium Security's self-protection driver, allows local attackers to escalate to SYSTEM privileges. The Zero Day Initiative assigned a CVSS score of 7.8 to the vulnerability.

CVE-2026-5424

CRITICAL

Critical Code Execution Flaw Patched in NI LabVIEW

A critical vulnerability (CVE-2026-32861) in NI LabVIEW allows remote attackers to execute arbitrary code by tricking a user into opening a malicious LVCLASS file, with a CVSS score of 7.8.

CVE-2026-32861

DriveLock Directory Traversal Vulnerability Exposes Sensitive System Information

MEDIUM

DriveLock Directory Traversal Vulnerability Exposes Sensitive System Information

A directory traversal vulnerability (CVE-2026-5492) in DriveLock endpoint security software allows authenticated attackers to read arbitrary files, potentially exposing sensitive system information and configuration data.

CVE-2026-5492

DriveLock Privilege Escalation Flaw Allows Attackers to Bypass Security

DriveLock Privilege Escalation Flaw Allows Attackers to Bypass Security

A critical SQL injection vulnerability (CVE-2026-5490) in DriveLock endpoint security software allows authenticated attackers to escalate privileges and bypass the product's own security controls, according to the Zero Day Initiative.

CVE-2026-5490

GIMP HDR File Parsing Vulnerability Enables Remote Code Execution

GIMP HDR File Parsing Vulnerability Enables Remote Code Execution

A heap-based buffer overflow vulnerability (CVE-2026-2050) in the GNU Image Manipulation Program (GIMP) allows remote attackers to execute arbitrary code when a user opens a malicious HDR image file.

CVE-2026-2050

GStreamer qtdemux Flaw Enables Remote Code Execution

GStreamer qtdemux Flaw Enables Remote Code Execution

A stack-based buffer overflow vulnerability (CVE-2026-5056) in the GStreamer multimedia framework's qtdemux component allows remote attackers to execute arbitrary code, posing a risk to numerous media-processing applications.

CVE-2026-5056

HP DeskJet 2855e Printer Vulnerable to Remote Code Execution

HP DeskJet 2855e Printer Vulnerable to Remote Code Execution

A stack-based buffer overflow vulnerability (CVE-2026-4682) in the HP DeskJet 2855e printer allows network-adjacent attackers to execute arbitrary code without authentication, earning a CVSS score of 8.8.

CVE-2026-4682

Linux Kernel ETS Scheduler Race Condition Enables Local Privilege Escalation

Linux Kernel ETS Scheduler Race Condition Enables Local Privilege Escalation

A race condition vulnerability (CVE-2025-71066) in the Linux kernel's ETS scheduler can allow local attackers to escalate privileges to root, earning a CVSS score of 7.5 from the Zero Day Initiative.

Lumma Stealer Campaign Deploys Sectop RAT via Malicious PDFs

A new campaign delivers the Lumma information stealer, which subsequently installs the Sectop RAT (ArechClient2) to establish persistent remote access on compromised Windows systems, using malicious PDF files as the initial infection vector.

Microsoft Patches Windows win32kfull Local Privilege Escalation Vulnerability

Microsoft Patches Windows win32kfull Local Privilege Escalation Vulnerability

Microsoft has patched a local privilege escalation vulnerability (CVE-2026-33104) in the Windows win32kfull driver, which could allow authenticated attackers to gain SYSTEM privileges. The flaw was disclosed by the Zero Day Initiative.

CVE-2026-33104

Microsoft vcpkg OpenSSL Vulnerability Enables Local Privilege Escalation

Microsoft vcpkg OpenSSL Vulnerability Enables Local Privilege Escalation

A vulnerability (CVE-2026-34054) in the Microsoft vcpkg port of OpenSSL allows local attackers to escalate privileges on affected systems, earning a CVSS score of 7.8.

CVE-2026-34054

Microsoft Windows Secure Kernel Double Free Vulnerability Enables Local

Microsoft Windows Secure Kernel Double Free Vulnerability Enables Local

A double-free vulnerability (CVE-2026-26179) in the Microsoft Windows Secure Kernel allows local attackers to escalate privileges, potentially to SYSTEM. The flaw, rated 7.5 CVSS, requires an attacker to first execute high-privileged code.

CVE-2026-26179