CVE-2026-61356 Windows Remote Desktop Services Elevation of Privilege Vulnerability

...

CVE-2026-61356 Windows Remote Desktop Services Elevation of Privilege Vulnerability

...

CVE-2026-49179 Windows Active Directory Domain Services Remote Code Execution Vulnerability

...

CVE-2026-49179 Windows Active Directory Domain Services Remote Code Execution Vulnerability

...

CVE-2026-28757

The CVE-2026-28757 entry refers to a protection mechanism failure in Intel(R) Workload Services Framework software operating in Ring 3 (User Applications). The vulnerability could allow an escalation of privilege by an unprivileged adversary paired with a privileged user, requiring local access, ...

CVE-2026-28757

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

CVE-2026-28757

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

CVE-2026-28757

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

EUVD-2026-56526

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Windows Management Services Denial of Service Vulnerability

Improper link resolution before file access 'link following' in Windows Management Services allows an authorized attacker to deny service locally...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Application Information Services Elevation of Privilege Vulnerability

Use after free in Application Information Services allows an authorized attacker to elevate privileges locally...

CVE-2026-73210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution RCE against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft ar...

CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...