PT-2026-58632

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

PT-2026-58616

Name of the Vulnerable Software and Affected Versions Windows Remote Access Service Infrastructure affected versions not specified Description An integer overflow or wraparound in the Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network...

ROS-20260714-73-0064

The vulnerability in Grafana relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-49791: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

Siemens SIMATIC S7-PLCSIM Advanced

SUMMARY SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. 2. GENERAL RECOMMENDATIONS As a...

PT-2026-58692

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device...

PT-2026-58489

Name of the Vulnerable Software and Affected Versions Windows Remote Access Connection Manager affected versions not specified Description A use-after-free condition exists in the Windows Remote Access Connection Manager RasMan. This flaw allows an authorized attacker to elevate privileges over a...

CVE-2026-56647: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network...

CVE-2026-50451: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

CVE-2026-62657: Missing Validation of OpenSSL Certificate

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device...

CVE-2026-50666: Use After Free

Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-57096: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

CVE-2026-10577: Missing Authentication for Critical Function

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface CLI commands. If exploited, a threat actor...

CVE-2026-15594

A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from...

Directory Traversal

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Directory Traversal through the lang query parameter in the language-loading code in src/api.lang.ts and src/lang.ts. An attacker can read certain JSON files outside the shared folders by sending a crafted...

CVE-2026-61505

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

PYSEC-2026-2383 AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass

A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astrmainagent of the file astrbot/core/astrmainagent.py. Such manipulation of the argument sessionid leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly availab...

CVE-2026-15559 CodeAstro Simple Online Leave Management System POST accept.php sql injection

A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the component POST Handler. Performing a manipulation of the argument appid results in sql injection. The attack is possible to be...

CVE-2026-15544

A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This manipulation of the argument Field causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has be...

CVE-2026-15542

A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...