Do Son 
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog with four new entries. The agency has confirmed evidence of active exploitation for all four flaws, requiring Federal Civilian Executive Branch (FCEB) agencies to patch immediately.
The first flaw is CVE-2008-0015. This Microsoft Windows Video ActiveX Control flaw originally terrorized the internet in July 2009.
The vulnerability involves a stack-based buffer overflow in the msvidctl.dll library. By tricking a user into visiting a crafted webpage, attackers can execute arbitrary code on systems running legacy software like Windows XP and Server 2003. Its resurgence in the KEV catalog suggests that threat actors are successfully hunting down ancient, unpatched infrastructure that organizations have forgotten or failed to decommission.
The second flaw is CVE-2026-2441, a cutting-edge Use-After-Free vulnerability in Google Chrome’s CSS engine.
Unlike the Microsoft bug, this flaw targets modern users. The vulnerability allows a remote attacker to “execute arbitrary code inside a sandbox via a crafted HTML page”. It affects Chrome versions prior to 145.0.7632.75, making it a prime vector for drive-by compromise against users browsing the web today.
The remaining two vulnerabilities include:
- TeamT5 ThreatSonar (CVE-2024-7694): This anti-ransomware tool ironically becomes a gateway for attackers. The flaw allows remote attackers with administrative privileges to upload malicious files because the software “does not properly validate the content of uploaded files”.
- Zimbra Collaboration Suite (CVE-2020-7796): A Server-Side Request Forgery (SSRF) vulnerability affecting ZCS versions before 8.8.15 Patch 7. This flaw exploits the WebEx zimlet, allowing attackers to manipulate server requests if the zimlet is enabled.
Related Posts:
- Critical Alert: Chrome Zero-Day (CVE-2026-2441) Exploited in the Wild
- Microsoft to Disable ActiveX Controls in Office 365 and 2024
- Linux Considers Dropping Support for Ancient i486 and i586 CPUs
- CISA Alert: Chinese Hackers Weaponize CVSS 10 Cisco Zero-Day & SonicWall Exploit Chains
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
