187 matches found
Microsoft WebP Image Extension < 1.2.31.0 RCE (CVE-2026-70351) (September 2026)
The version of the Microsoft WebP Image Extension app installed on the remote Windows host is prior to 1.2.31.0. It is, therefore, affected by a remote code execution vulnerability: - Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code...
CVE-2026-70351
Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...
CVE-2026-69649
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...
EUVD-2026-73147
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...
CVE-2026-69649
CVE-2026-69649 is a heap-based buffer overflow in the Windows Raw Image Extension that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior privileges, with a CVSS 3.1 score of 8.8 (HIGH) reflecting high impact o...
CVE-2026-70351
CVE-2026-70351 is an integer overflow or wraparound in Microsoft WebP Image Extension that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 base score is 8.8 (High) , with low attack complexity and no privileges required, though user interaction is req...
EUVD-2026-73078
Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...
Raw Image Extension Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...
Microsoft WebP Image Extension Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...
CVE-2026-70351: Integer Overflow or Wraparound
Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...
CVE-2026-69649: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...
PT-2026-87641
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...
GHSA-645J-CM4X-3XVW Concrete CMS Vulnerable to Relative Path Traversal
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable file...
CVE-2026-8134
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable file...
CVE-2026-8134 Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable file...
CVE-2026-8134
Concrete CMS 9.5.0 and earlier fails to sanitize path traversal in the ptComposerFormLayoutSetControlCustomTemplate field when saving page-type composer form layouts. An authenticated rogue administrator with composer form editing rights can cause arbitrary readable files to be included on the se...
PT-2026-26374
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG sanitizer make it possible to upload and render an SVG that runs malicious JavaScript. An extension of .png with content type of...
EUVD-2020-9057
Malware in sbrugna...