~/jackwent.co.uk
jack@jackwent:~$ tail -f /var/log/vulns

Vulnerability Feeds & Zero-Days

vulns.logconnecting…
  1. [netsec]PHP rce CVE-2026-109618
  2. [netsec]France had more Internet-exposed Danfoss refrigeration dashboards than the rest of the world combined before the supermarket attacks (weekly IPv4 scan data)
  3. [netsec]CVE-2026-46633: Proving exploitability of Twig sandbox bypass
  4. [netsec]The OffiDocs Browser Extension Campaign
  5. [netsec]All vulnerabilities are now race conditions
  6. [netsec]How I got over 300 Tor exit nodes removed
  7. [netsec]CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCE
  8. [netsec]Prompt injection, XSS and SIEM-exfil payloads living in reverse DNS, plus 28 fake Googlebots that passed FCrDNS
  9. [netsec]How practical is 100k requests per second? Introducing h3fuzz
  10. [netsec]Unauthenticated SQL injection in GLPI (≤ 11.0.8)
  11. [netsec]CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE
  12. [netsec]PhantomBuffer: Effective EDR Evasion Through Stealth Injection
  13. [netsec]16% of RPKI-covered IPv4 routes still allow a forged-origin hijack that passes validation, the setup behind the Virtualizor update attack
  14. [netsec]CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU
  15. [netsec]The Cloudflare Appstore (Appflare) Malware Audit
  16. [netsec]Web Environment Integrity vs. Private Access Tokens - They're the same thing!
  17. [netsec]PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
  18. [zdi]ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
  19. [zdi]ZDI-26-784: FreeBSD Kernel kqueue Use-After-Free Local Privilege Escalation Vulnerability
  20. [zdi]ZDI-26-783: LibreOffice PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
  21. [zdi]ZDI-26-782: LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
  22. [zdi]ZDI-26-781: LibreOffice EMF+ Brush Integer Overflow Remote Code Execution Vulnerability
  23. [zdi]ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability
  24. [zdi]ZDI-26-779: (0Day) Sparx Systems Enterprise Architect XSLT Debugger XML External Entity Processing Information Disclosure Vulnerability
  25. [netsec]Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
  26. [zdi]ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
  27. [zdi]ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
  28. [zdi]ZDI-26-776: QNAP TS-453E syslog log_message Format String Remote Code Execution Vulnerability
  29. [zdi]ZDI-26-775: GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
  30. [zdi]ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
  31. [zdi]ZDI-26-773: NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
  32. [zdi]ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability
  33. [zdi]ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
  34. [zdi]ZDI-26-770: SonicWall Secure Mobile Access unzip Directory Traversal Remote Code Execution Vulnerability
  35. [zdi]ZDI-26-769: X.Org Server XKB XkbSetMap Request Out-Of-Bounds Read Information Disclosure Vulnerability
  36. [zdi]ZDI-26-768: X.Org Server XInput ProcXIPassiveUngrabDevice Heap-based Buffer Overflow Privilege Escalation Vulnerability
  37. [zdi]ZDI-26-767: X.Org Server Glamor CopyArea Heap-based Buffer Overflow Privilege Escalation Vulnerability
  38. [zdi]ZDI-26-766: X.Org Server RandR Heap-based Buffer Overflow Privilege Escalation Vulnerability
  39. [zdi]ZDI-26-765: X.Org Server XKB Heap-based Buffer Overflow Privilege Escalation Vulnerability
  40. [zdi]ZDI-26-764: X.Org Server XFixes Pointer Barrier Heap-based Buffer Overflow Privilege Escalation Vulnerability
  41. [zdi]ZDI-26-763: X.Org Server XKB XkbResizeKeyType Numeric Truncation Privilege Escalation Vulnerability
  42. [zdi]ZDI-26-762: X.Org Server GLX RenderLarge Heap-based Buffer Overflow Privilege Escalation Vulnerability
  43. [zdi]ZDI-26-761: X.Org Server XInput Passive Grab Use-After-Free Information Disclosure Vulnerability
  44. [zdi]ZDI-26-760: X.Org Server Present Extension Use-After-Free Information Disclosure Vulnerability
  45. [zdi]ZDI-26-759: X.Org Server XKB TextDoodad Double Free Privilege Escalation Vulnerability
  46. [zdi]ZDI-26-758: Docker Buildx Filesystem Entitlements Protection Mechanism Failure Remote Code Execution Vulnerability
  47. [zdi]ZDI-26-757: (0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability
  48. [netsec]AhsayCBS Deep-Dive: Auth Bypass to RCE
  49. [netsec]Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector
  50. [netsec]We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983
  51. [netsec]Playing It SFAPE: Code Execution in Isolated User Mode
  52. [zdi]ZDI-26-756: (0Day) Genesis World load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
  53. [zdi]ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery Vulnerability
  54. [zdi]ZDI-26-754: (0Day) Genesis World URDF Directory Traversal Information Disclosure Vulnerability
  55. [zdi]ZDI-26-753: (0Day) Genesis World MJCF Directory Traversal Information Disclosure Vulnerability
  56. [zdi]ZDI-26-752: (0Day) Genesis World decompress_usdz Directory Traversal Remote Code Execution Vulnerability
  57. [netsec]Google paid me $90,000 for this RCE
  58. [netsec]r/netsec monthly discussion & tool thread
  59. [zdi]ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
  60. [zdi]ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability

Security moves fast, and keeping on top of it means having the right information as soon as it’s out. After 20+ years in IT I’ve learned how much difference it makes to hear about a new vulnerability early, especially a zero day, before someone gets the chance to exploit it.

That’s what this page is for. It pulls the latest advisories, vulnerability reports and security news into one live feed, so you can spot what affects you and get your patching priorities sorted.

I work in infrastructure for a living, so I know how hard it is to keep track of everything while also keeping the lights on. I use this feed myself, and I hope it saves you some time too.

Use the feed in your own tools

Everything on this page is also available as JSON, so you can pull it into a dashboard, a script or a chat bot. It’s free, read-only and needs no key.

curl -s https://jackwent.co.uk/api/feeds | jq '.items[:5]'

You get back three things:

  • updated: when the feed last refreshed
  • sources: each source, whether its last fetch worked, and how many items it has
  • items: every headline, newest first, each with a source (zdi, ncsc, f5, netsec, sysadmin or hn), a title, a link and a date

The feed refreshes every 15 minutes, so there’s no point polling more often than that. The full description is in the OpenAPI spec, and the service health check is at /healthz.

If there’s a feed you’d like me to add, drop me a line at info@jackwent.co.uk.

Just so you know, the links in the feed take you away from jackwent.co.uk to other sites.

Thanks to the sources behind this page, which refreshes every 15 minutes:

[jackwent]