CVE-2026-87928: Unrestricted Upload of File with Dangerous Type

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

Security Advisory 0153

Security Advisory 0153 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added Description On affected platforms running Arista EOS, under certain circumstances plaintext private keys...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

SUSE CVE-2026-78043

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used vulnerability discovered by ? in WordPress Npm next versions = 10.0.0, 15.5.24...

GHSA-2XP9-VWFH-VXW4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled...

CVE-2026-78625 Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

EUVD-2026-74070

ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...

CVE-2026-83991

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally...

CVE-2026-81821

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

CVE-2026-80093

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69289

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

CVE-2026-69279

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

EUVD-2026-73932

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

CVE-2026-81821

CVE-2026-81821 affects AVEVA Pipeline Integrity Monitor (PIMBoards) due to the use of a hard-coded cryptographic key . An attacker with local read access to PIMBoards project files can decrypt and view sensitive information stored within them. The CVSS 3.1 score is 8.4 (HIGH) with changed scope, ...

EUVD-2026-73438

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

EUVD-2026-73359

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally...

CVE-2026-83991

CVE-2026-83991 affects the Windows Cloud Files Mini Filter Driver , where a missing authentication check on a critical function allows a locally authenticated attacker to perform tampering . The vulnerability is rated CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges re...