// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
A NoMachine nxwebrunner heap-based buffer overflow, CVE-2026-114549, enables unauthenticated remote code execution and is rated CVSS 9.8.
-
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
A vulnerability in NVIDIA Megatron Bridge YAML parsing can allow remote code execution when users open malicious files or visit malicious pages.
-
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
Cisco Snort has a stack-based buffer overflow in OLE VBA decompression that can allow unauthenticated remote code execution.
-
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
OpenSSL CMP has a remote information disclosure vulnerability, tracked as CVE-2026-63073, requiring no authentication.
-
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
OpenSSL contains a vulnerability in CMS AuthEnvelopedData integrity check validation that could allow tampering by network-adjacent attackers.