110319 matches found
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
EUVD-2026-65223
GitPython: clonefrom/clone omit --separate-git-dir from unsafegitcloneoptions, enabling arbitrary git-directory creation outside the destination...
GHSA-8MCC-HRX5-HVXC GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...
CVE-2026-69809
Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network...
CVE-2026-69546
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-69524
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-69359
Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally...
CVE-2026-62813
Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network...
CVE-2026-62801
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-62762
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
EUVD-2026-74034
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...
CVE-2026-69809
CVE-2026-69809 is a memory leak (missing release of memory after effective lifetime) in Windows Active Directory Domain Services that allows an unauthorized, unauthenticated attacker to trigger a denial of service over the network. The CVSS 3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/...
EUVD-2026-73609
Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network...
EUVD-2026-73534
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-69546
CVE-2026-69546 is a use-after-free vulnerability in Windows Active Directory Domain Services that allows an unauthorized attacker to achieve remote code execution over the network. The CVSS 3.1 score is 8.1 (High) with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high attack comple...
CVE-2026-69482
Windows Error Reporting contains a local tampering vulnerability caused by the creation of a temporary file in a directory with insecure permissions , allowing an authorized attacker to tamper with data locally. The vulnerability is rated CVSS 7.1 (HIGH) with a vector of local attack, low complex...
SUSE CVE-2026-81830
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...
CVE-2026-62813
CVE-2026-62813 is a use after free vulnerability in Windows Active Directory Domain Services (AD DS) that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The CVSS 3.1 score is 7.5 (HIGH) with high complexity and no user interaction required. No expl...