CVE-2026-42645

Cross-Site Request Forgery CSRF vulnerability in Dmitry V. CEO of "UKR Solution" Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: fro...

ISPB

🛡️ AI-powered Security Scanner Platform A next-generation...

CVE-2026-40420: Improper Access Control

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally...

CVE-2026-40401: NULL Pointer Dereference

Windows TCP/IP Denial of Service Vulnerability...

CVE-2026-40361: Use After Free

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-34339: NULL Pointer Dereference

Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally...

CVE-2026-34332: Use After Free

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network...

CVE-2026-30805: Initialization of a Resource with an Insecure Default

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800...

CVE-2026-6865: Improper Limitation of a Pathname to a Restricted Directory

CWE-22: Improper Limitation of a Pathname to a Restricted Directory “Path Traversal” vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing...

CVE-2026-4827: Insufficient Entropy

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections...

CVE-2026-1681: Uncontrolled Recursion

Issuing an ICMP ping via the net ping shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo request and the resulting echo reply are...

CVE-2026-44278: Use of Hard-coded Cryptographic Key

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via...

CVE-2026-42831: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-43929: Incomplete List of Disallowed Inputs

ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address e.g. http://::ffff:127.0.0.1/. The WHATWG URL parser bui...

CVE-2026-40359: Use After Free

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-41095: Use After Free

Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally...

CVE-2026-35440: Files or Directories Accessible to External Parties

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

CVE-2026-34187: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800...

CVE-2026-30807: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800...

CVE-2026-27851: Improper Handling of Extra Parameters

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No...