CVE-2026-1949

Delta Electronics AS320T is affected by CVE-2026-1949 due to an incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service. The available reports identify the host device and the vulnerable component as the AS320T web service handling GET/PUT requests,...

Oracle多款产品 安全漏洞

Oracle Java SE, among others, are products of Oracle Corporation in the United States. Oracle Java SE is a tool used for developing and deploying Java applications for desktop, server, embedded devices, and real-time environments. Oracle GraalVM is a just-in-time compiler written in the Java...

DesktopEditors 安全漏洞

DesktopEditors is an open-source offline office suite developed by ONLYOFFICE, supporting editing of documents, spreadsheets, presentations, and PDFs. Versions of DesktopEditors prior to 9.3.0 contained a security vulnerability. This vulnerability stemmed from defects in the update service, which...

PT-2026-33271

In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges...

AMD EPYC Processor 安全漏洞

The AMD EPYC Processor is a series of multi-core processors developed by American semiconductor company AMD. There is a security vulnerability in the AMD EPYC Processor, which stems from improper use of the boot service. This vulnerability may lead to privilege escalation and arbitrary code...

CVE-2026-40193

maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll without any LDAP filter escaping, despite the...

CVE-2026-26160 Remote Desktop Licensing Service Elevation of Privilege Vulnerability

...

CVE-2026-26160

CVE-2026-26160 affects the Windows Remote Desktop Licensing Service. The issue arises from missing authentication for a critical function, enabling an authorized local attacker to elevate privileges on affected systems. The CVE has a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, lo...

Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SSDP Service allows an authorized attacker to elevate privileges locally...

squid security update

An update is available for squid. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy caching server for web clients, supporting FT...

CVE-2026-4374

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional Cloud Discovery Service, Recording Service, Routing Service, Queueing Service, Observability Collector allows Serialized Data External Linking, Data Serialization External Entities Blowup.This issue...

ROS-20260401-73-0031

Vulnerability in libpng12 related to buffer copying without checking input size. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2026-4486

D-Link DIR-513 (firmware 1.10) Web Service: The formEasySetPassword function in /goform/formEasySetPassword is vulnerable. Manipulating the curTime argument leads to a stack-based buffer overflow, with remote access possible. The exploit is publicly available, and this affects products no longer ...

EUVD-2026-12862

An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service ReDoS via a crafted input...

ASUS Business System Control Interface 安全漏洞

ASUS Business System Control Interface is a system control interface developed by ASUS, a Chinese technology company. There is a security vulnerability in the ASUS Business System Control Interface. This vulnerability stems from improper permission allocation, which may allow unauthorized local...

EUVD-2026-10617

Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

CVE-2026-28549

Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability...

Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint

Summary The /api/v1/account/forgot-password endpoint returns the full user object including PII id, name, email, status, timestamps in the response body instead of a generic success message. This exposes sensitive user information to unauthenticated attackers who only need to know a valid email...

CVE-2026-28549

Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability...