CVE-2026-87051

A flaw was found in operator-foundry. The path-containment check, designed to restrict file access within a build context, only performs string-based validation. It fails to resolve symbolic links symlinks, allowing an attacker to create a symlink within the build context that points to files or...

CVE-2026-86422

A flaw was found in ImageMagick. This vulnerability, known as a time-of-check-time-of-use TOCTOU flaw, affects path policy enforcement on Windows. A local attacker can exploit this by manipulating symbolic links symlinks during the brief interval between when the system checks a file's permission...

Aegis aegis-v0.14.1-alpha

AEGIS is a desktop app for monitoring local AI agents and reviewing their files and selected actions. Inspect processes, sensitive-file observations, TCP endpoints and attribution evidence in Observatory. Monitoring requires no agent plugin; policy-controlled execution and MCP action tools requir...

Server-side Request Forgery (SSRF)

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolveContent method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches b...

EUVD-2026-74204

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...

CVE-2026-75998 ColdFusion | Improper Access Control (CWE-284)

ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...

CVE-2026-28659

MicroXR Blobstore in Android XR contains a missing permission check that allows access to files belonging to other applications. The vulnerability enables local privilege escalation without requiring additional execution privileges or user interaction. The Android CNA (Google) assigns a CVSS 4.0 ...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-81963

Improper link resolution before file access 'link following' in Windows Update Stack allows an authorized attacker to elevate privileges locally...

CVE-2026-70563

Improper link resolution before file access 'link following' in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-69379

Improper link resolution before file access 'link following' in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-67368

Improper link resolution before file access 'link following' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-77110 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...

CVE-2026-28624

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73971

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28624

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28624

A confused deputy vulnerability in Android allows unauthorized read/write access to files in multiple locations. This flaw enables a local attacker to achieve elevation of privilege without requiring additional execution privileges or user interaction. This issue is addressed in the July 2026 sec...

EUVD-2026-73956

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...