25558 matches found
CVE-2026-53412
CVE-2026-53412 affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. The root cause is improper input validation, allowing an unauthenticated, network-remote attacker to take over an account. Impact is high (CVE-2026-53412 CVSS v3.1: 9.8, CRITICAL...
CVE-2026-53412 Zoom Workplace VDI Plugin for Windows - Improper Input Validation
Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access...
CVE-2026-35148
HCL DFXServer is affected by a Missing Access Control vulnerability (CVE-2026-35148). The issue allows certain endpoints to be accessed without authentication in another browser, enabling any network user to invoke APIs without verification of identity or authorization. CVSS v3.1 base score: 6.3 ...
CVE-2021-27137
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...
RLSA-2026:39316 Moderate: cups security update
The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network CVE-2026-34980 For more details about...
CVE-2026-61435 PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...
VulnCheck KEV: CVE-2023-4346
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this...
Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments...
CVE-2026-47300
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
CVE-2026-47301
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...
CVE-2026-47303
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43878
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network...
EUVD-2026-44043
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-57982
Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network...
CVE-2026-57092
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network...
CVE-2026-56647
Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network...
CVE-2026-54116
Access of resource using incompatible type 'type confusion' in SQL Server allows an authorized attacker to disclose information over a network...
CVE-2026-50686
Access of resource using incompatible type 'type confusion' in Windows OLE allows an unauthorized attacker to execute code over a network...