CVE-2026-104024

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

CVE-2026-104024: Incomplete List of Disallowed Inputs

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

CVE-2026-14765

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, which permits all URL schemes. On Windows, this results in a call ...

CVE-2026-14765 Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, which permits all URL schemes. On Windows, this results in a call ...

EUVD-2026-100781

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, which permits all URL schemes. On Windows, this results in a call ...

CVE-2026-14765: Initialization of a Resource with an Insecure Default

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, which permits all URL schemes. On Windows, this results in a call ...

PT-2026-113608

Name of the Vulnerable Software and Affected Versions Unreal Engine versions prior to 5.8.1 Description The software contains an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, allowing a...

CVE-2026-109422

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

EUVD-2026-97817

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109422

The NetEase Cloud Music client for Windows (cloudmusic.exe ) versions 3.1.38 and 3.1.39.205426 is vulnerable to Remote Code Execution (RCE) . The flaw exists in the renderer-process IPC bridge os.navigateExternal, which fails to validate the URL scheme before passing caller-supplied URLs to Shell...

CVE-2026-109422: Exposed Dangerous Method or Function

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

EUVD-2026-94696

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-107448

The Magic: The Gathering Arena Windows/Steam client (versions 2026.59.30.12801.127931.6 and certain 2026.60.x builds) is vulnerable to a Resource Injection flaw. The application fails to validate the URI scheme or domain of a server-supplied URL received from a home-screen carousel GoToExternalUr...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-107448: Improper Control of Resource Identifiers

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

PT-2026-107802

Name of the Vulnerable Software and Affected Versions Magic: The Gathering Arena Windows/Steam client versions 2026.59.30.12801.127931.6 through 2026.60.x Description The application passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell usin...

CVE-2025-63680

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...

CVE-2025-63680

Nero BackItUp in the Nero Productline (versions 2019 through 2025) is vulnerable to a path parsing and UI rendering flaw (CWE-22 ). The vulnerability occurs because the software improperly renders file names and interacts with the Windows ShellExecuteW function. An attacker can create a folder wi...

CVE-2025-63680: Improper Limitation of a Pathname to a Restricted Directory

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...