WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...

CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-65789

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network...

CVE-2026-64912

Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally...

CVE-2026-62820

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DNS allows an unauthorized attacker to execute code over a network...

EUVD-2026-56773

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...

EUVD-2026-56770

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally...

EUVD-2026-56709

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...

EUVD-2026-56665

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

EUVD-2026-56649

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-68815

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68795

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68794

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-56427

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

Microsoft Outlook Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network...

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Active Directory allows an unauthorized attacker to execute code over a network...