109685 matches found
PT-2026-87527
Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network...
PT-2026-87017
Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.3 Snowflake Go Driver versions prior to 2.2.0 Snowflake JDBC Driver versions prior to 4.3.4 Snowflake Node.js Driver versions prior to 3.3.0 Snowflake PHP PDO Driver versions prior to 4.2.0...
PT-2026-89357
Name of the Vulnerable Software and Affected Versions Vim affected versions not specified Description Vim incorrectly handles certain tags files, which could allow an attacker to execute arbitrary code. Recommendations At the moment, there is no information about a newer version that contains a f...
CVE-2026-78625: Improper Control of Generation of Code
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
CVE-2026-79572: Improper Restriction of XML External Entity Reference
An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...
CVE-2026-62652: Insertion of Sensitive Information Into Debugging Code
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engine...
CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...
CVE-2026-69289: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...
CVE-2026-80093: Use After Free
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-83991: Missing Authentication for Critical Function
Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally...
CVE-2026-86668: Improper Neutralization of Input During Web Page Generation
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...
PT-2026-88050
Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description A type confusion and use-after-free issue exists in the Windows Cloud Files driver cldflt.sys, used by features like OneDrive Files On-Demand. The flaw is cause...
PT-2026-87336
Name of the Vulnerable Software and Affected Versions Windows Setup Files Cleanup affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At th...
CVE-2026-69279: Use After Free
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-86714: Out-of-bounds Read
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console outp...
PT-2026-88084
🚨 HIGH: CVE-2026-81821 CVSS 8.4 PIMBoards project files vulnerable to decryption attack. Threat actors with read access can decrypt sensitive data. Patch immediately. CVE Vulnerability ThreatIntel https://t.co/enlHrybEZY...
CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...
CVE-2026-86436
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...