388708 matches found
CVE-2026-70261: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...
CVE-2026-96186: Deserialization of Untrusted Data
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally...
CVE-2026-70260: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...
CVE-2026-100214: Deserialization of Untrusted Data
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network...
Microsoft .NET: CVE-2026-70035: .NET Framework Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network...
Microsoft .NET: CVE-2026-83520: .NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network...
PT-2026-111663
Name of the Vulnerable Software and Affected Versions Xenstore versions prior to 4.22.0 06-1.1 Description During a live update, the state record for a Xenstore watch with a specified watch depth is written with two bytes missing. This leads to an inconsistent state when the new Xenstore reads th...
ROS-20261013-73-0386
The vulnerability of the rtnlfillvfinfo function in the net/core/rtnetlink.c module, which is part of Linux’s kernel network functions, stems from the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...
PT-2026-111517
Name of the Vulnerable Software and Affected Versions NVIDIA AIStore for Linux affected versions not specified Description An issue exists in the legacy ETL Kubernetes PodSpec initialization API. A remote, unauthenticated attacker can inject Kubernetes host-namespace and container-security...
PT-2026-113473
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An observable discrepancy in the Media component allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using...
Microsoft Windows: CVE-2026-83870: Windows Aggregated Data Platform Service Information Disclosure Vulnerability
Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...
VulnCheck KEV: CVE-2025-13880
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets Google Reviews, YouTube Feed, Photo Feeds, and More plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings...
VulnCheck KEV: CVE-2024-12253
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'savesettings', 'exportcsv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it...
VulnCheck KEV: CVE-2026-3279
The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the downgradejqueryversion function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user...
VulnCheck KEV: CVE-2026-3045
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: 1 a non-user-bound publicnonce is exposed to unauthenticated users...
VulnCheck KEV: CVE-2026-13389
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...
VulnCheck KEV: CVE-2025-67911
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through = 4.11...
VulnCheck KEV: CVE-2026-8441
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprploadmorerevs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $POST'notinstring' and passed through sanitizetextfield — which strips HTML and...
PT-2026-111384
Name of the Vulnerable Software and Affected Versions Siemens S7-1500 affected versions not specified Description Devices fail to properly validate and sanitize visual marker data within imported CSV trace files before rendering the information on the Trace page. An attacker could social engineer...
Microsoft Windows: CVE-2026-83639: Windows Sensor Data Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...