PT-2026-97517

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description The 'administrator/index.php?option=com easystore&task=appconfig.updateConfiguration' endpoint allows the update of core Joomla mail configuration in the configuration.php file without...

Windows Exploitation Techniques: Dangling COM Object Registrations

Posted by James Forshaw This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug wa...

PT-2026-95908

Name of the Vulnerable Software and Affected Versions Dromara UJCMS versions prior to 12.3.2 Description An improper authorization issue exists in the UserController component. A remote attacker can manipulate the Username variable within the usernameExist function of the...

CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-69299

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-69294

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

EUVD-2026-73439

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

CVE-2026-69294

Microsoft COM for Windows is affected by an information disclosure vulnerability caused by the generation of an error message containing sensitive information. An authorized local attacker can exploit this to disclose information, with no user interaction required. The CVSS 3.1 score is 5.5 (Medi...

EUVD-2026-73434

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-69299

Microsoft COM for Windows is affected by a use-after-free vulnerability that allows an authorized local attacker to achieve privilege escalation. The CVSS 3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, and low required privileges. No user interaction is needed, and all thr...

Microsoft COM for Windows Elevation of Privilege Vulnerability

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

Microsoft COM for Windows Information Disclosure Vulnerability

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

PT-2026-87341

Name of the Vulnerable Software and Affected Versions Microsoft COM for Windows affected versions not specified Description An issue in Microsoft COM for Windows allows an authorized attacker to locally disclose sensitive information through the generation of error messages. Recommendations At th...

CVE-2026-69299: Use After Free

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

PT-2026-87346

Name of the Vulnerable Software and Affected Versions Microsoft COM for Windows affected versions not specified Description A use-after-free condition in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs...

CVE-2026-69294: Generation of Error Message Containing Sensitive Information

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

CVE-2026-86282

A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument...

Silabs CP210x VCP virtual COM port driver Privilege Escalation

The vulnerability of the Silabs CP210x VCP virtual COM port driver is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary code...

org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-84371 via org.webjars.npm:sanitize-html (2.7.0)

org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...

com.51degrees:device-detection (>=4.4.1, <=4.4.2), com.51degrees:geo-location.web.examples.mvc (>=4.3.10, <=4.3.11) +132 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (4.3.30.release)

org.springframework:spring-webmvc MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.51degrees:device-detection =4.4.1, =4.3.10, =4.3.10, =4.3.14, =4.3.14, =4.3.14,...