New 7-Zip Vulnerability CVE-2026-14266 Allows Code Execution via Crafted XZ Archives
A critical vulnerability in 7-Zip, identified as CVE-2026-14266, allows attackers to execute arbitrary code by tricking users into opening a specially crafted…
Category: Critical CVEs
Critical and exploited CVEs, vulnerability intelligence and remediation guidance.
CVE-2026-14266: 7-Zip XZ Archive Heap-Based Buffer Overflow
CVE-2026-14266 is a heap-based buffer overflow vulnerability in 7-Zip's XZ decoder, specifically in the MixCoder_Code function. It allows an attacker to execute…
CVE-2026-48095: 7-Zip NTFS Handler Heap-Write Overflow
CVE-2026-48095 is a heap-write overflow vulnerability in 7-Zip's NTFS handler, fixed in version 26.01. It was detailed by GitHub Security Lab with…
CVE-2026-42533: Critical NGINX Heap Buffer Overflow
A heap buffer overflow in NGINX's script engine allows unauthenticated remote attackers to crash worker processes or potentially execute arbitrary code. Affects…
CVE-2026-9256: NGINX Rewrite Module Overlapping Captures Bug
A heap overflow in NGINX's rewrite module due to overlapping captures, disclosed in May 2026. Similar class of flaw as CVE-2026-42533, involving…
Critical NGINX Heap Buffer Overflow CVE-2026-42533 Allows DoS and Potential RCE
F5 has patched a critical heap buffer overflow vulnerability in NGINX, tracked as CVE-2026-42533, which can crash worker processes and may allow…
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
A previously undocumented threat actor, tracked as UTA0533 by Volexity, exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series…
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
A critical unauthenticated remote code execution vulnerability has been discovered in WordPress core, affecting versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.…
CVE-2026-XXXX: WordPress Core Unauthenticated RCE via REST API Batch-Route Confusion and SQL Injection
A critical vulnerability in WordPress core allows unauthenticated remote code execution through a REST API batch-route confusion and SQL injection issue. Affects…
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
Okta's Red Team has disclosed a denial-of-service vulnerability in OpenSSL, dubbed HollowByte, that allows an attacker to freeze server memory using 11-byte…