PT-2026-37124

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.3.8 Description A command injection issue exists in the runMac function within the file github.com/elcterm/electerm/npm/install.js:150. The function appends the remote releaseInfo.name variable, which can be...

Remote Desktop Licensing Service Privilege Escalation

The vulnerability of the Remote Desktop Licensing Service in the Windows operating system is related to the lack of authentication for a critical function. Exploiting this vulnerability can allow attackers to increase their privileges...

Windows Function Discovery Privilege Escalation

The vulnerability of the Function Discovery service in Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

Windows Ancillary Function Driver WinSock Privilege Escalation

The vulnerability of the Windows Ancillary Function Driver for WinSock in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain elevated privileges...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-007209)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007209 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irpthreadfunc because the IRP is freed by...

KB5061197: Windows Server 2008 OOB Security Update (May 2025) (CVE-2025-32709)

The remote Windows host is missing a security update and is therefore affected by an elevation of privilege vulnerability: - Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. CVE-2025-32709 Note that Nessus has n...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2026-007186)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007186 advisory. Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function on Unix-like systems. By...

SUSE CVE-2026-40499

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's printgvars function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted...

GHSA-G82G-M9VX-VHJG Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

Summary The client-side escapeForHtml function in KimaiEscape.js, introduced in commit 89bfa82c 2959 to fix a JavaScript XSS vulnerability, only escapes , and & but does not escape " double quote or ' single quote. When user-controlled data profile alias is placed in an HTML attribute context...

CVE-2026-6134

A security flaw has been discovered in Tenda F451 1.0.0.7cnsvn7958. This vulnerability affects the function fromqossetting of the file /goform/qossetting. Performing a manipulation of the argument qos results in stack-based buffer overflow. The attack is possible to be carried out remotely. The...

CVE-2026-33100

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-32150

Concurrent execution using shared resource with improper synchronization 'race condition' in Function Discovery Service fdwsd.dll allows an authorized attacker to elevate privileges locally...

CVE-2026-32087

Heap-based buffer overflow in Function Discovery Service fdwsd.dll allows an authorized attacker to elevate privileges locally...

CVE-2026-32086

Concurrent execution using shared resource with improper synchronization 'race condition' in Function Discovery Service fdwsd.dll allows an authorized attacker to elevate privileges locally...

CVE-2026-32093

Concurrent execution using shared resource with improper synchronization 'race condition' in Function Discovery Service fdwsd.dll allows an authorized attacker to elevate privileges locally...

CVE-2026-26182

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-26177

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-26168

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-6384 Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing

A flaw was found in gimp. This buffer overflow vulnerability in the GIF image loading component's ReadJeffsImage function allows an attacker to write beyond an allocated buffer by processing a specially crafted GIF file. This can lead to a denial of service or potentially arbitrary code execution...

CVE-2026-40917

A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the icnsslurp function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process...