CVE-2026-80074: Heap-based Buffer Overflow

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

CVE-2026-83998: Heap-based Buffer Overflow

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

PT-2026-87362

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description An out-of-bounds read exists that allows an authorized attacker to disclose sensitive information over a network, potentially affecting the system. Recommendations At the moment...

CVE-2026-69317: Out-of-bounds Read

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network...

CVE-2026-57098: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network...

PT-2026-88284

Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network...

NewStart CGSL MAIN 7.02 : nginx Multiple Vulnerabilities (NS-SA-2026-0104)

The remote NewStart CGSL host, running version MAIN 7.02, has nginx packages installed that are affected by multiple vulnerabilities: - When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate...

PT-2026-87178

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via...

CVE-2026-76967: Deserialization of Untrusted Data

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...

PT-2026-87973

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description An integer overflow or wraparound occurs in the Remote Desktop Client, which allows an unauthorized attacker to cause a denial of service over a network. Recommendations At the...

PT-2026-87576

Name of the Vulnerable Software and Affected Versions Windows SMB Client affected versions not specified Description An out-of-bounds read in the Windows SMB Client allows an authorized attacker to disclose sensitive information over a network, which can subsequently affect the system. An...

CVE-2026-82758

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82753

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

CVE-2026-82758

ash_authentication_oauth2_server (ash-project, Elixir) has an Improper Authentication flaw in resolve_secret/3: any secret-provider return other than {:ok, _} or :error was treated as valid, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value,...

EEF-CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Summary Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through...

EUVD-2026-72540

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82753 Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...