NewsThe Hacker News
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Linked advisories
- CVE-2026-108186Zoom Workplace: unzureichende Eingabevalidierung
- CVE-2026-108186Zoom Video Communications Workplace: Mehrere Schwachstellen ermöglichen Privilegieneskalation
- CVE-2026-108186Zoom Workplace: unzureichende Eingabevalidierung
- CVE-2026-108186Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
Affected vendors and products
More on Unauthenticated
Other advisories
- MediumCVE-2026-129447Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascr…
- Not ratedosv:CVE-2026-127115BuddyForms <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode
- Not ratedCVE-2026-119258The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated att…
- Not ratedCVE-2026-117487The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not r…
- CriticalCVE-2026-124020Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the…
- MediumCVE-2026-128886A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial …
- MediumCVE-2026-9870IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScrip…
- CriticalCVE-2026-82504VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attacker…
Other news entries
- Hackers Exploit New N-central Zero-Day Hours After PoC PublicationNewsSecurityWeek
- Apache HTTP Server patches critical HTTP/2 remote code execution flawNewsBleepingComputer
- Cisco BroadWorks Out-of-Band Blind XML External Entity Injection VulnerabilityNewsCisco PSIRT
- Apache Patches Critical HTTP Server RCE Found by Anthropic, GoogleNewsSecurityWeek
- Hackers Target N-central Zero-Days as N-able Rushes PatchesNewsSecurityWeek
- Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on FailoverNewsThe Hacker News
- Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' DataNewsThe Hacker News
- Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code RemotelyNewsThe Hacker News
Source: https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html
ID