EUVD-2026-56508

Improper authentication for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may...

CVE-2026-20885

CVE-2026-20885 concerns the Intel(R) TDX module on certain Intel platforms, where improper authentication in the Ring 0 Trust Domain can enable information disclosure and privilege escalation. The NVD/CVE records describe a local-attack scenario requiring a privileged user, with high attack compl...

CVE-2026-20885

Improper authentication in the IntelR TDX module for some IntelR platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This...

EUVD-2026-56505

Improper authentication in the IntelR TDX module for some IntelR platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This...

CVE-2026-20752

Technical details about CVE-2026-20752 are not publicly provided in the supplied documents; no affected products, versions, or fixes are disclosed. Monitor for updates from NVD/CVE sources.

CVE-2026-20752

Improper authentication for some IntelR PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...

EUVD-2026-56487

Improper authentication for some IntelR PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...

CVE-2026-20713

Always-incorrect control flow implementation in some firmware for some IntelR XeonR processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via...

CVE-2026-19078

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18638

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

EUVD-2026-56237

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

CVE-2026-19078

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-72920

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

CVE-2026-72746

A flaw was found in FreeRDP. An unauthenticated remote attacker could bypass the server-side authentication in the RDSTLS Remote Desktop Services Transport Layer Security handshake. By sending a Capabilities PDU instead of the expected Authentication Request PDU, the server incorrectly processes...

CVE-2026-10050

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

EUVD-2026-56187

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-72922

Summary: CVE-2026-72922 affects AutoGPT prior to version 0.6.70. The root cause is in autogpt_platform/backend/backend/api/features/integrations/router.py, where the webhook_ingress_generic route selects the webhook manager using the untrusted provider URL segment without verifying webhook.provid...