ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-05-13
•6 min read
GitLab CE/EE CVE-2026-1659: Brief Summary of Unauthenticated DoS via CI/CD Job Update API
A short review of CVE-2026-1659, a high severity denial of service vulnerability in GitLab's CI/CD job update API that allows unauthenticated attackers to exhaust resources via crafted requests. Includes patch details and affected version ranges.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•5 min read
Quick Look: CVE-2026-29205 — Arbitrary File Read in cPanel cpdavd Attachment Endpoints
A brief summary of CVE-2026-29205, a high severity arbitrary file read vulnerability in cPanel's cpdavd service caused by incorrect privilege management and insufficient path filtering. Includes patch details across all affected release branches.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-32992 — Disabled SSL Verification in cPanel DNS Cluster Enables Credential Interception
A short review of CVE-2026-32992, a high severity improper certificate validation flaw in cPanel and WHM's DNS Cluster system that could allow credential theft via man in the middle attacks. Includes patch details across all affected branches.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-32993 — Unauthenticated HTTP Header Injection in cPanel & WHM via nova_error Endpoint
A short review of CVE-2026-32993, a high severity HTTP header injection vulnerability in cPanel & WHM that allows unauthenticated attackers to inject arbitrary response headers via the nova_error endpoint. Patch information and affected versions are included.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-34343 — Windows AppID Subsystem Heap Overflow Enables Local Privilege Escalation
A short review of CVE-2026-34343, a heap-based buffer overflow in the Windows Application Identity (AppID) Subsystem that allows locally authenticated attackers to escalate privileges. Includes patch information across all affected Windows product families.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-34344 — Windows AFD Type Confusion Enables Local Privilege Escalation to SYSTEM
A short review of CVE-2026-34344, a type confusion vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that allows a low privileged local attacker to escalate to SYSTEM. Patch information and affected versions are included.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Quick Look: CVE-2026-34347 — Windows Win32K Use After Free Elevation of Privilege
A brief summary of CVE-2026-34347, a use after free vulnerability in the Windows Win32K GRFX subsystem that allows local privilege escalation to SYSTEM. Includes technical details, affected versions, and patch information across all supported Windows platforms.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Brief Summary: Windows TCP/IP Race Condition Privilege Escalation (CVE-2026-34351)
A short review of CVE-2026-34351, a high severity race condition in the Windows TCP/IP stack that enables local privilege escalation. Includes patch details across all affected Windows client and server editions.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•5 min read
Brief Summary: CVE-2026-35415 Windows Storage Spaces Controller Integer Overflow Privilege Escalation
A short review of CVE-2026-35415, a CVSS 7.8 integer overflow vulnerability in the Windows Storage Spaces Controller that enables local privilege escalation across a wide range of Windows client and server operating systems.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Quick Look: CVE-2026-35416 — Use After Free in Windows WinSock Driver Enables Local Privilege Escalation
A brief summary of CVE-2026-35416, a use after free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that allows local privilege escalation to SYSTEM. Includes patch details across 31 affected Windows configurations and threat intelligence context.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Quick Look: CVE-2026-35417 — Windows Win32k ICOMP Type Confusion Privilege Escalation
A brief summary of CVE-2026-35417, a type confusion vulnerability in the Windows Win32K ICOMP kernel subsystem that enables local privilege escalation to SYSTEM. Includes patch details, detection methods, and affected version matrix.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Brief Summary: CVE-2026-35418 Windows Cloud Files Mini Filter Driver Use After Free Privilege Escalation
A short review of CVE-2026-35418, a use after free vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that allows local privilege escalation to SYSTEM. Includes patch details across 17 affected Windows product versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Brief Summary: CVE-2026-35420 Windows Kernel Heap Buffer Overflow Enables Local Privilege Escalation
A short review of CVE-2026-35420, a heap-based buffer overflow in the Windows Kernel that allows locally authenticated attackers to escalate privileges to SYSTEM. Patch information covering all affected Windows client and server versions is included.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Windows GDI CVE-2026-35421: Brief Summary of a Heap Buffer Overflow Leading to Local Code Execution
A brief summary of CVE-2026-35421, a heap-based buffer overflow in the Windows GDI subsystem that allows local code execution when a user opens a crafted EMF file. Patch information covering 31 product and platform combinations is included.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-35424 Windows IKE Protocol Memory Leak Denial of Service
A short review of CVE-2026-35424, a memory leak vulnerability in the Windows Internet Key Exchange (IKE) Protocol that enables unauthenticated remote denial of service. Includes patch details and affected version information.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•5 min read
Brief Summary: CVE-2026-35433 — .NET Elevation of Privilege via Improper Input Validation and Integer Overflow
A short review of CVE-2026-35433, an elevation of privilege vulnerability in .NET 8.0, 9.0, and 10.0 caused by improper input validation and integer overflow. Includes patch details and affected version information.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-35436 Elevation of Privilege in Microsoft Office Click-to-Run via Access Control Weakness
A short review of CVE-2026-35436, a high severity elevation of privilege vulnerability in Microsoft Office Click-to-Run caused by insufficient access control granularity, along with patch details and affected build numbers across all servicing channels.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Brief Summary: CVE-2026-35438 — Windows Admin Center Privilege Escalation via Missing Authorization in Update API
A short review of CVE-2026-35438, a missing authorization flaw in the Windows Admin Center update API that lets low privileged authenticated users install arbitrary software versions, along with patch details for the official fix in version 2.6.5.16.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•6 min read
Microsoft SharePoint Server CVE-2026-35439: Brief Summary of an Authenticated Deserialization RCE
A brief summary of CVE-2026-35439, a high severity deserialization vulnerability in Microsoft SharePoint Server that enables authenticated remote code execution. Includes patch details for all affected on premises editions.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-13
•7 min read
Brief Summary: Microsoft SharePoint Server RCE via Deserialization (CVE-2026-40357)
A short review of CVE-2026-40357, a high severity deserialization vulnerability in Microsoft SharePoint Server that enables authenticated remote code execution. Includes patch details for all affected SharePoint editions.
ZeroPath CVE Analysis
