37325 matches found
CVE-2026-69911: Use After Free
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
CVE-2026-69785: Untrusted Search Path
Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally...
PT-2026-88312
Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that...
CVE-2026-69328: Untrusted Search Path
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally...
Adobe Photoshop 26.x < 26.11.7 / 27.x < 27.7 Multiple Vulnerabilities (macOS APSB26-130)
The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 26.11.7/27.7. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-130 advisory. - Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that could...
CVE-2026-86499
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-86499
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-86499
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-86499
JetBrains YouTrack before version 2026.1.14047 contained an information disclosure flaw in its predefined search fields , which leaked all group names to any user regardless of their visibility permissions. The vulnerability is rated CVSS 4.3 (Medium) with a network attack vector, low complexity,...
EUVD-2026-72515
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...
CVE-2026-12853
The Flamingo plugin for WordPress (versions up to and including 2.6.2 ) is vulnerable to an authorization bypass. The plugin's flamingo_map_meta_cap() filter restricts access to its admin UI but does not extend to WordPress core APIs, specifically XML-RPC wp.getTerms and admin-ajax ajax-tag-searc...
Vulnerabilities in GeoNetwork are addressed through OpenGeo
OpenGeo has identified several vulnerabilities in GeoNetwork, a open-source cataloging application, specifically in versions 4.4.5 through 4.4.11, as well as versions preceding 4.4.12 and 4.2.17. The first vulnerability involves a reflected cross-site scripting XSS attack in the public,...
CVE-2026-81738
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries...
EUVD-2026-72278
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries...
CVE-2026-81738
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver is vulnerable to an out-of-bounds write triggered by crafted DOMAIN-SEARCH entries. The CVSS 4.0 base score is 2.3 (LOW) , reflecting high attack complexity, a required attack condition, and only low impact to integrity, availab...
CVE-2026-81738
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries...
CVE-2026-81738
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries...
CVE-2026-12853: Missing Authorization
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...