CVE-2026-67179 Genkit improper host header validation

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

EUVD-2026-56240

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CVE-2026-72746

A flaw was found in FreeRDP. An unauthenticated remote attacker could bypass the server-side authentication in the RDSTLS Remote Desktop Services Transport Layer Security handshake. By sending a Capabilities PDU instead of the expected Authentication Request PDU, the server incorrectly processes...

CVE-2026-18129

CVE-2026-18129 affects the Core of Ivanti Endpoint Manager prior to version 2024 SU7. The issue is cleartext transmission of sensitive information, allowing a remote, unauthenticated attacker in a MITM position to leak credentials used for external SQL connections. CVSS v3.1 metrics report high i...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

CVE-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

CVE-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

GHSA-XH95-F55M-82FW vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-12074 vulnerabilities

Vulnerabilities for packages: open-webui...

Windows Installer Elevation of Privilege Vulnerability

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally...

Remote Procedure Call Denial of Service Vulnerability

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network...

Microsoft Office Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network...

Windows DHCP Server Information Disclosure Vulnerability

Integer underflow wrap or wraparound in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network...

Visual Studio Code Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

Microsoft PowerShell Remote Code Execution Vulnerability

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network...

Windows Network File System Denial of Service Vulnerability

Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network...

Windows DNS Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network...

CVE-2026-46670

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...