EUVD-2026-56435

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally...

EUVD-2026-56436

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally...

EUVD-2026-56604

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally...

EUVD-2026-56184

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

EUVD-2026-56785

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-42976

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally...

CVE-2026-42976

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally...

CVE-2026-42976 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

...

CVE-2026-65672

CVE-2026-65672 is a Windows vulnerability describing a heap-based buffer overflow in the Windows Remote Access API. An authorized attacker can elevate privileges locally. CVSS v3.1 metrics: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; base score 7.8 (HIGH). Attack vector is LOCAL, with LOW complexity and...

CVE-2026-65672 Remote Access API Elevation of Privilege Vulnerability

...

CVE-2026-65671

The CVE-2026-65671 entry describes a heap-based buffer overflow in Windows Remote Access API that allows an authorized attacker to achieve local privilege escalation. The impact is indicated as high (CVSSv3.1 base score 7.8) with local access required and no user interaction. Public details in th...

CVE-2026-65671 Remote Access API Elevation of Privilege Vulnerability

...

CVE-2026-73079

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

CVE-2026-42142

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

CVE-2026-18640

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

CVE-2026-48766

TypeBot (chatbot builder) before version 3.17.0 exposes OpenAI API keys stored in workspaces. A low-privilege guest can exfiltrate credentials by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerability decrypts the workspace credential, constructs an OpenAI...

AI Genie in the Wild

When I give talks about AI genies, I use this sort of example as a hypothetical. It's happened. The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And…. Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several wee...

EUVD-2026-56237

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

CVE-2026-42142

TypeBot (pre-3.17.0) exposes an authorization bypass in the GET/Sheets endpoint: POST /api/sheets/getSheets does not validate workspace membership, enabling any authenticated user to access and decrypt another workspace’s Google Sheets OAuth credentials and retrieve spreadsheet data (names, IDs, ...

CVE-2026-42142 TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...