EUVD-2026-63383

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management...

CVE-2026-16923

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management...

CVE-2026-16923 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management...

CVE-2026-61897

An Ubuntu-specific AccountsService patch before 23.13.9-8ubuntu7 changes only the effective UID/GID to the target user while leaving the real UID as root (0). A shell spawned by a language helper script inherits ruid=0 and can reset its effective UID to root, enabling local privilege escalation t...

EUVD-2026-63377

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with...

CVE-2026-76993

GreyDGL PentestGPT up to 1.0.0 has an injection flaw in the Web-Page Crawling component, triggered by manipulating a Traceback argument. The exploit is remotely exploitable with high complexity, has a public PoC, and the vendor closed the GitHub issue as "not planned" with no patch indicated. Exp...

CVE-2026-76993 GreyDGL PentestGPT Web-Page Crawling injection

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with...

CVE-2026-55558 aiosmtplib: STARTTLS response injection

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

Microsoft Fabric Elevation of Privilege Vulnerability

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

Azure Arc Elevation of Privilege Vulnerability

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

Windows Remote Help Defense Spoofing Vulnerability

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally...

Microsoft Word Information Disclosure Vulnerability

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

Microsoft Remote Help Denial of Service Vulnerability

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally...

Azure Virtual Machines Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

Azure Data Factory Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63373

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...

CVE-2026-64960

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...