261488 matches found
CVE-2026-18706 Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, executi...
Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, executi...
CVE-2026-73222
Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...
CVE-2026-56179
creationtimestamp| type| source ---|---|--- 2026-08-11 18:13:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117078230441993880 2026-08-11 19:02:07+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 20:18:44+00:00| seen|...
CVE-2026-62815
creationtimestamp| type| source ---|---|--- 2026-08-11 17:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mst6gv5bm42q 2026-08-11 19:00:38+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 20:16:33+00:00| seen|...
CVE-2026-71476
A flaw was found in Nx. The self-hosted HTTP remote cache component improperly extracts downloaded cache artifacts, allowing files to be written outside the intended directory. A malicious or on-path Man-in-the-Middle remote cache server can exploit this Zip-Slip vulnerability by providing a...
openjdk-orb: unauthed class loading via IIOP in EAP
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-73212 coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...
EUVD-2026-56786
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including...
CVE-2026-71331
Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network...
CVE-2026-70337
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network...
CVE-2026-70329
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
CVE-2026-70321
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
CVE-2026-69320
Improper neutralization of special elements used in an os command 'os command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-70130
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...
CVE-2026-65815
Deserialization of untrusted data in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...
CVE-2026-65807
Access of resource using incompatible type 'type confusion' in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
CVE-2026-65791
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network...