261993 matches found
CVE-2026-54131
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-54124
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally...
CVE-2026-50498
Windows Universal Disk Format File System Driver UDFS Elevation of Privilege Vulnerability...
CVE-2026-50383
Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally...
CVE-2026-50352
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
CVE-2026-45756
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...
CVE-2026-42975
creationtimestamp| type| source ---|---|--- 2026-07-14 18:12:15+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116919680066922390 2026-07-14 19:01:34+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 19:48:34+00:00| seen|...
CVE-2026-54250
creationtimestamp| type| source ---|---|--- 2026-07-14 18:11:53+00:00| seen| https://gist.github.com/alon710/0aa2b5000c5f8b16f18b0419c2e76818...
CVE-2026-56164
creationtimestamp| type| source ---|---|--- 2026-07-14 18:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/668b2838-95c6-4ab3-abc0-8c35823f659e 2026-07-14 18:20:38+00:00| seen| https://bsky.app/profile/cvesentinel.bsky.social/post/3mqmt3pfil62x...
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...
CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-15757 Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router
A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has n...
CVE-2026-51821
creationtimestamp| type| source ---|---|--- 2026-07-14 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmqbeydro2w...
CVE-2026-59197
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...
DEBIAN-CVE-2026-59884
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with C...
CVE-2026-55001
Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally...
CVE-2026-50520
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code locally...
CVE-2026-59888
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...
UBUNTU-CVE-2026-59888
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...