CVE-2026-28618: Heap-based Buffer Overflow

In decfrmprepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-86737: Missing Authorization

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-81357: Server-Side Request Forgery (SSRF)

Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-0065: Protection Mechanism Failure

In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is...

CVE-2026-69383: External Control of File Name or Path

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-28624: Unintended Proxy or Intermediary

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69473: Use After Free

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-76202: Incorrect Authorization

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-81790: Missing Authorization

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8...

CVE-2026-28671: Time-of-check Time-of-use (TOCTOU) Race Condition

In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-78742: Improper Neutralization of Input During Web Page Generation

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-70577: Use After Free

Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

Exploit for SQL Injection in Okfn Ckan

🛡️ CVE-2026-42031 Scanner SQL Injection Scanner untuk CKAN...

CVE-2026-86540: Improper Neutralization of Special Elements used in an OS Command

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

CVE-2026-86491: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

CVE-2026-86482: Incorrect Privilege Assignment

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

CVE-2026-86544: Incorrect Authorization

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...

Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8727-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8727-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through th...

CVE-2026-86541: Improper Limitation of a Pathname to a Restricted Directory

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2025-52657: Allocation of Resources Without Limits or Throttling

HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability...