91185 matches found
CVE-2026-28622: Missing Authorization
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28618: Heap-based Buffer Overflow
In decfrmprepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-55273: Improper Input Validation
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-49927: Integer Overflow or Wraparound
In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-78742: Improper Neutralization of Input During Web Page Generation
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...
CVE-2026-69524: Use After Free
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-86737: Missing Authorization
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-69362: Use After Free
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally...
CVE-2026-71377: Improper Neutralization of Argument Delimiters in a Command
Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...
CVE-2026-71376: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, fr...
CVE-2026-84820: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...
CVE-2026-69322: Double Free
Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network...
CVE-2026-69473: Use After Free
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-77505: Use After Free
Use after free in DNS Server allows an unauthorized attacker to execute code over a network...
CVE-2026-81379: Not Failing Securely
Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-81357: Server-Side Request Forgery (SSRF)
Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69989: Use After Free
Use after free in DNS Server allows an unauthorized attacker to execute code over a network...
CVE-2026-69708: Use After Free
Use after free in Windows Web Platform Storage allows an authorized attacker to elevate privileges locally...