264628 matches found
EUVD-2026-48453
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...
OESA-2026-3136 dracut security update
dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...
OESA-2026-3102 qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code ...
CVE-2026-56165
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network...
CVE-2026-54120
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
EUVD-2026-48436
9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....
EUVD-2025-210506
Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...
EUVD-2026-48457
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability
...
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability
...
CVE-2026-50517
CVE-2026-50517 describes a deserialization vulnerability in Microsoft 365 Copilot (M365 Copilot) that enables an authorized attacker to execute code over the network. The issue is triggered by deserializing untrusted data, with a critical CVSS v3.1 score (9.9, CRITICAL) and a network attack vecto...
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
...
CVE-2026-35425
CVE-2026-35425 concerns Azure API Management (APIM) with an “Improper access control” condition that enables a network-exposed remote code execution by an authorized attacker. Affected software is APIM; the root cause is access-control weaknesses that allow code execution over the network. The pr...
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
...
PT-2026-64444
Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...
