CVE-2026-54990

CVE-2026-54990 describes a heap-based buffer overflow in the Remote Desktop Client that allows an unauthenticated attacker to execute code over the network. The issue is characterized as high severity (CVSS v3.1 base score 9.8, CRITICAL) with network attack vector, no privileges required, and no ...

CVE-2026-50663

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network...

CVE-2026-45496

The CVE-2026-45496 entry describes a path traversal vulnerability in Visual Studio Code where improper limitation of a pathname to a restricted directory allows local attackers to bypass a security feature. Affected component is Visual Studio Code (path handling/file access) with the root cause b...

CVE-2026-49172

The CVE-2026-49172 entry describes a heap-based buffer overflow in Windows FTP Service that allows an unauthenticated, network-based attacker to execute code remotely. Documents confirm the vulnerability exists in Windows FTP Service and enables remote code execution with network access and no re...

CVE-2026-49164

CVE-2026-49164 affects Active Directory Domain Services (AD DS). The vulnerability is described as a heap-based buffer overflow in AD DS that allows an unauthenticated, network-based attacker to execute code remotely. Public sources in the provided documents consistently label this as an executio...

CVE-2026-34349

CVE-2026-34349 describes a local information disclosure in Windows Media where sensitive data is exposed to an unauthorized actor, potentially enabling a local attacker with low privileges and no user interaction to disclose information. The report notes a CVSSv3.1 base score of 5.5 (Medium), wit...

CVE-2026-52839

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

CVE-2026-48815

A flaw was found in sigstore. The certificateOIDs option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface API but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing...

CVE-2026-59839

CVE-2026-59839 describes a path traversal vulnerability: improper limitation of a pathname to a restricted directory in Fortinet products, affecting FortiOS (versions 7.6.0–7.6.6, 7.4.0–7.4.9, 7.2.x, 7.0.x, 6.4.x), FortiPAM (1.8.0 down to 1.0, all 1.x releases), and FortiProxy (7.6.0–7.6.5, 7.4–7...

Windows FTP Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network...

Microsoft Edge Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to execute code over a network...

Windows Push Notification Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally...

Windows Push Notification Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally...

Windows Data.dll Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally...

Windows Server Update Service (WSUS) Tampering Vulnerability

Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network...

Windows Spaceport.sys Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack...

Windows USB Video Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack...

Microsoft Bing App for IOS Spoofing Vulnerability

Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network...

Windows Push Notification Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally...