PT-2026-58435

Name of the Vulnerable Software and Affected Versions Microsoft Brokering File System affected versions not specified Description A use-after-free UAF issue exists in the bfs.sys Windows kernel minifilter driver within the Brokering File System. This flaw is caused by synchronization errors when...

PT-2026-58401

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An out-of-bounds read in the Windows NTFS file system allows an authorized local attacker to elevate their privileges. An out-of-bounds read occurs when a program reads data past the end...

PT-2026-58461

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description A use after free flaw in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network. Use after free is a memory corruption issue that occurs when...

PT-2026-58183

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description Improper privilege management in Microsoft Windows DNS allows an authorized attacker to locally bypass a security feature. Recommendations At the moment, there is no information...

CVE-2026-61627

GHSA-pjjp-65r7-ppgm: Out-of-bounds read and write in wraplinesmeasure...

PT-2026-58404

Name of the Vulnerable Software and Affected Versions Windows Internal System User Profile affected versions not specified Description A use after free issue in the Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. Use after free is a memory...

PT-2026-58439

Name of the Vulnerable Software and Affected Versions Windows Ancillary Function Driver for WinSock affected versions not specified Description External control of a file name or path in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

openSUSE 16: libipa_hbac-devel / libipa_hbac0 / libnfsidmap-sss / etc (openSUSE-SU-2026:21290-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21290-1 advisory. This update for sssd fixes the following issues - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by...

SUSE SLES15 Security Update : kernel (Live Patch 12 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:2894-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2894-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.53 fixes various security issues The following security issues were fixed: -...

Mozilla Firefox < 152.0.6

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 152.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-67 advisory. - We are aware that exploit code for this is public however we are not aware of any attacks in the wild...

KLA91152 Multiple vulnerabilities in Microsoft System Center

Multiple vulnerabilities were found in Microsoft System Center. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An...

CVE-2026-57855 Cockpit CMS Missing Authorization in Bucket File Storage API

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

MAL-2026-10513 Malicious code in nodemon-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1d2f1b3c8848137e0ec6a9897d6f4056102623f1139549c9dd928fcb4482e69 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nodemon-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1d2f1b3c8848137e0ec6a9897d6f4056102623f1139549c9dd928fcb4482e69 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10512 Malicious code in type-unique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b576b19c56055dbc3638b361d0071c669108b9a6f8756828cadee4214d57bb13 [email protected] presents itself as the pino logger matching README, keywords, and package shape but on require its index.js spawns a detached node...

CVE-2026-51821

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint...

CVE-2026-15684

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system...

CVE-2026-15597 SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /editexam2.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been release...

CVE-2026-62328 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation historie...

Security Bulletin: Due to use of NodeJS, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Due to use of NodeJS libraries, IBM Cloud Pak System Software is affected by multiple vulnerabilities. These have been addressed in IBM Cloud Pak System Software version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-22036 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to...