CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

CVE-2026-8919

CVE-2026-8919 affects ASUS GameSDK. A permissive cross-domain policy with untrusted domains could let a remote user induce a local UNC request to the application’s local service endpoint, exposing a local NTLM hash and enabling information disclosure, data tampering, or service disruption. The is...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

CVE-2026-46485: External Control of System or Configuration Setting

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized...

ROS-20260715-73-0005

The vulnerability of the ajpmsggetstring function in the Apache HTTP Server relates to reading data beyond the permitted range of memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-60259

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized...

ROS-20260715-73-0010

The vulnerability of the HTTP/2 protocol implementation in the Apache HTTP Server is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...

Apache HTTP Server mod_proxy_ftp DoS

The vulnerability of the modproxyftp module in the Apache HTTP Server is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

OData Unlimited Resource Distribution DoS

The vulnerability of libraries for integrating the OData protocol in modern ASP.NET-based web applications, such as Microsoft.AspNet.OData and Microsoft.AspNetCore.OData, is related to unlimited resource distribution. Exploiting this vulnerability can allow a malicious actor to cause service...

TOTOLINK NR1800X Form_Logout() Code Execution

The vulnerability of the FormLogout function in the /formLogout.htm file of the TOTOLINK NR1800X router microprogramming system is related to the operation of writing data outside the buffer in memory when processing the Host parameter. Exploiting this vulnerability allows an attacker to execute...

MP4Box Heap Buffer Overflow DoS

The vulnerability of the elngboxread function in the src/isomedia/boxcodebase.c file, belonging to the MP4Box encoder of the GPAC multimedia platform, is related to the execution of operations outside of the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...

Assimp Buffer Overflow

The vulnerability of the Open Asset Import Library Assimp, a library for importing 3D models, is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code and cause service interruptions...

CVE-2026-47988

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access, causing a limited disruption to availability...

EUVD-2026-44327

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable...

EUVD-2026-43695

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device...

Azure Active Directory Denial of Service Vulnerability

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-51537

A flaw was found in OpENer. An out-of-bounds read vulnerability exists in the Connection Manager when processing malformed ForwardOpen requests. A remote attacker can send a specially crafted Ethernet/IP ENIP frame with an insufficient Common Industrial Protocol CIP ForwardOpen/LargeForwardOpen...

CVE-2026-44747

CVE-2026-44747 affects SAP NetWeaver Application Server ABAP. An authenticated attacker can exploit logical errors in memory management to trigger memory corruption, leading to unauthorized data access, modification, or system unavailability. Impact is described as high for confidentiality, integ...