CVE-2026-92378: Insufficient Session Expiration

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be...

PT-2026-97238

Name of the Vulnerable Software and Affected Versions NT-ware uniFLOW Online affected versions not specified Description A session management issue exists in the Legacy UI Reduced Function Login feature. Under specific timing conditions during Service Offline Emergency Mode, a session that was...

PT-2026-95001

Name of the Vulnerable Software and Affected Versions SolarWinds Access Rights Manager versions prior to 2026.2.1.7 Description An unauthenticated remote code execution issue exists due to a hardcoded shared HMAC secret included in the installer that is identical across all deployments. The gRPC...

CVE-2026-76159

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

EUVD-2026-78330

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

CVE-2026-76159 Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

Exploit for Improper Authorization in Microsoft

certighost-oneclick CVE-2026-54121 Certighost – One-Click...

Malicious code in avangs-olium-nt (npm)

Source: amazon-inspector 9cb983febd18968a8597732bf01c611ca293ca69c6a38ec0b596c88fa6ef2550 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

PT-2026-89505

Name of the Vulnerable Software and Affected Versions Tesseract versions 5.5.3 and earlier Description A heap out-of-bounds write occurs during the first recognition step on the default LSTM engine when processing a crafted NT LSTM layer. This happens because NetworkIO::WriteTimeStepPart and...

EUVD-2026-63896

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-14208: Incorrect Permission Assignment for Critical Resource

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

ActFax Server 10.70 Remote Code Execution

ActFax Server version 10.70 contains an unauthenticated remote code execution vulnerability in its LPD service. A remote attacker can submit a crafted print job containing an @F211 fax destination and PostScript content that abuses the Ghostscript pipe operator. When the document is rasterized by...

EUVD-2026-57713

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

PT-2026-71382

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITYSYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

EUVD-2026-57239

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...

CVE-2026-14479 Denial of Service in Autodesk Installer IPC Channel

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...

CVE-2026-14479: Improper Validation of Specified Index, Position, or Offset in Input

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...

PT-2026-71097

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITYSYSTEM...