ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-05-27
•10 min read
Quick Look: CVE-2026-8994 Authentication Bypass in Login with NEAR WordPress Plugin
A brief summary of CVE-2026-8994, a high severity authentication bypass in the Login with NEAR WordPress plugin that allows unauthenticated attackers to log in as any user, including administrators, via a single crafted POST request with no wallet ownership verification.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-27
•9 min read
Keycloak CVE-2026-9795: Brief Summary of FGAPv2 Privilege Escalation via Scope Mapping Bypass
A brief summary of CVE-2026-9795, a high severity privilege escalation in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature that allows delegated administrators to inject arbitrary realm roles into client scope mappings, poisoning authentication tokens for downstream users.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•7 min read
Brief Summary: NVIDIA Linux Display Driver CVE-2026-24187 Use After Free Vulnerability
A short review of CVE-2026-24187, a high severity use after free vulnerability in the NVIDIA Linux display driver that can lead to privilege escalation and code execution, along with patch details across multiple driver branches and vGPU components.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•8 min read
Brief Summary: NVIDIA GPU Display Driver CVE-2026-24190 Kernel Mode Missing Authorization Vulnerability
A short review of CVE-2026-24190, a high severity missing authorization flaw in the NVIDIA GPU Display Driver kernel mode layer affecting Windows and Linux. Includes patch details across all driver branches and affected product families.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•8 min read
Quick Look: CVE-2026-24191 NVIDIA Display Driver TOCTOU Race Condition Enables Privilege Escalation on Windows
A brief summary of CVE-2026-24191, a high severity TOCTOU race condition in the NVIDIA Display Driver for Windows that can lead to privilege escalation and code execution. Includes patch details across all affected driver branches and vGPU software.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•12 min read
NVIDIA Linux Display Driver CVE-2026-24192: Heap Buffer Overflow via Numeric Type Conversion — A Brief Summary
A brief summary of CVE-2026-24192, a CVSS 7.8 heap buffer overflow in NVIDIA's Linux display driver caused by incorrect numeric type conversion. Covers affected driver branches, patch versions, detection methods, and compensating controls for environments running NVIDIA GPUs.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
NVIDIA GPU Display Driver CVE-2026-24193: Overview of a High Severity Out of Bounds Write Affecting Millions of Systems
A brief summary of CVE-2026-24193, a CVSS 7.8 out of bounds write in the NVIDIA GPU Display Driver for Windows and Linux. Includes patch details, detection methods, and affected version information across the R580 and R535 driver branches.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
NVIDIA Linux Display Driver CVE-2026-24194: Brief Summary of a High Severity Kernel Permission Flaw
A brief summary of CVE-2026-24194, a high severity improper permission handling vulnerability in NVIDIA's Linux GPU display driver kernel mode layer, covering technical details, affected versions across R595, R580, and R535 branches, and available patch information.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
Brief Summary: CVE-2026-24200 — NVIDIA vGPU Manager Use After Free Enables VM Escape
A short review of CVE-2026-24200, a high severity use after free vulnerability in the NVIDIA Virtual GPU Manager that could allow a guest VM to compromise the hypervisor host. Includes patch details and affected version information.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
Babel CVE-2026-44728: Brief Summary of Arbitrary Code Execution via SystemJS Module Transform
A brief summary of CVE-2026-44728, a high severity code injection vulnerability in Babel's SystemJS module transform plugin that allows attacker crafted source code to produce compiled output containing arbitrary JavaScript. Includes patch analysis and affected version details.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•9 min read
Quick Look: Check Point VPN CVE-2026-48131 Heap Out of Bounds Write via IKE Fragment Reassembly
A brief summary of CVE-2026-48131, a high severity heap out of bounds write in Check Point VPN's IKE fragment reassembly logic that enables remote denial of service. Includes patch details, detection methods, and affected version information.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
Quick Look: CVE-2026-48132, Check Point Quantum Security Gateway IKE NAT-T Denial of Service via Out-of-Bounds Read
A brief summary of CVE-2026-48132, a high severity denial of service vulnerability in Check Point Quantum Security Gateway caused by improper length validation in IKE packets over NAT-T (UDP 4500). Includes patch details, detection methods, and affected version information.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•9 min read
Brief Summary: CVE-2026-7374 KubeVirt virt-handler Symlink Following Vulnerability Enables Full Cluster Compromise
A brief summary of CVE-2026-7374, a symlink following vulnerability in KubeVirt's virt-handler component that allows an authenticated user with namespace edit permissions to escalate privileges and potentially compromise an entire Kubernetes cluster via CRI-O socket hijacking.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
Brief Summary: CVE-2026-8620 HTTP Request Smuggling in IBM WebSphere Web Server Plug-ins
A short review of CVE-2026-8620, a high severity HTTP request smuggling vulnerability in IBM Web Server Plug-ins for WebSphere Application Server and Liberty, including patch details and its relationship to a companion CVSS 9.8 RCE flaw in the same component.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
Brief Summary: CVE-2026-8633 Critical RCE via Code Injection in IBM WebSphere Web Server Plug-ins
A short review of CVE-2026-8633, a CVSS 9.8 remote code execution vulnerability in IBM WebSphere Web Server Plug-ins that allows unauthenticated attackers to compromise systems via specially crafted HTTP requests. Patch information and affected version details are included.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
Quick Look: CVE-2026-8760 — WordPress Login with OTP Plugin Authentication Bypass via Unrestricted OTP Brute Force
A brief summary of CVE-2026-8760, a critical authentication bypass in the WordPress Login with OTP plugin (versions up to 1.6) caused by misplaced rate limiting that allows unauthenticated brute force of 6-digit OTPs against any user account.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
IBM HTTP Server CVE-2026-8834: Heap Buffer Overflow in the Administration Server — Quick Look and Patch Guidance
A brief summary of CVE-2026-8834, a high severity heap buffer overflow in the IBM HTTP Server Administration Server affecting versions 8.5 and 9.0, including patch details and remediation guidance for enterprise teams.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
IBM HTTP Server CVE-2026-8855: Code Injection via TLS Mutual Authentication — Brief Summary and Patch Guidance
A brief summary of CVE-2026-8855, a high severity code injection vulnerability in IBM HTTP Server affecting TLS mutual authentication configurations. Includes affected versions, patch information, and remediation guidance.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-26
•10 min read
IBM WebSphere Web Server Plug-ins CVE-2026-9170: HTTP Request Smuggling with a Critical Companion CVE — Quick Look
A brief summary of CVE-2026-9170, a high severity HTTP request smuggling vulnerability in IBM Web Server Plug-ins for WebSphere Application Server and Liberty, including patch details and its relationship to a companion CVSS 9.8 remote code execution flaw addressed in the same bulletin.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-21
•5 min read
Quick Look: CVE-2026-2740 — ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus Authenticated Remote Code Execution
A brief summary of CVE-2026-2740, a high severity command injection vulnerability in three ManageEngine products that allows authenticated domain users to execute arbitrary commands on agent endpoints via a third party dependency flaw.
ZeroPath CVE Analysis
