CVE-2025-10314

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files EXE or DLLs in the installation directory with specially...

Finalwire AIDA64 缓冲区错误漏洞

Finalwire AIDA64 is a system information, diagnosis, and auditing tool developed by the Hungarian company Finalwire, running on the Microsoft Windows platform. Version 5.50.2100 of Finalwire AIDA64 contains a buffer error vulnerability, which stems from improper handling of the file opening...

GHSA-VRHW-V2HW-JFFX SignalK Server has Path Traversal leading to information disclosure

Summary A Path Traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId function blocks forward slashes / but not backslashes , which are treated as...

SignalK Server has Path Traversal leading to information disclosure

Summary A Path Traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId function blocks forward slashes / but not backslashes , which are treated as...

CVE-2025-36098

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources...

EUVD-2025-206565

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic...

EUVD-2025-206560

IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element...

Linux Distros Unpatched Vulnerability : CVE-2026-24413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set...

CVE-2025-36366

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow a user to cause a denial of service by executing a query that invokes the JSONObject scalar function, which may trigger an unhandled exception leading to abnormal server termination...

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal

File Read Interface Case Bypass Vulnerability Vulnerability Name File Read Interface Case Bypass Vulnerability Overview The /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can...

Mozilla Thunderbird < 147.0.1

The version of Thunderbird installed on the remote Windows host is prior to 147.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-07 advisory. - When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of ...

CVE-2026-0705

CVE-2026-0705 is a local privilege escalation vulnerability caused by insecure folder permissions. The affected product is Acronis Cloud Manager (Windows) , with versions prior to build 6.4.25342.354 . Multiple sources (NVD, Red Hat, CIRCL, CVE list) corroborate the same issue and affected line, ...

beat-access for Windows may insecurely load Dynamic Link Libraries

Overview beat-access for Windows provided by FUJIFILM Business Innovation Corp. contains the following vulnerability which may lead to insecurely loading Dynamic Link Libraries. Uncontrolled search path element CWE-427 - CVE-2026-21408 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported...

Stable Channel Update for Desktop

The Stable channel has been updated to 144.0.7559.109/.110 for Windows/Mac and 144.0.7559.109 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

CVE-2025-30248

DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path...

HTC IPTInstaller code-related vulnerabilities

HTC IPTInstaller is a Windows platform tool plugin developed by HTC Corporation in the United States. Version 4.0.9 of HTC IPTInstaller contains a code vulnerability; this vulnerability stems from the service path not being enclosed in quotes, which may allow for the execution of arbitrary code...

CVE-2025-14295

Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability CWE-257 in the Web session management component allows an attacker to access stored passwords in a recoverable format whi...

CVE-2026-23988

CVE-2026-23988 affects Rufus 4.11 and earlier. A TOCTOU race in the Fido PowerShell script handling (in src/net.c) occurs while the script is created, validated, and executed. Rufus runs with Administrator privileges but writes the script to %TEMP% (writable by standard users) without proper lock...

CVE-2025-14295

The CVE-2025-14295 entry describes a vulnerability in the WebCTRL (Automated Logic) and Carrier i-Vu products on Windows, focused on Web session management. Affected components: storing passwords in a recoverable format (CWE-257) which could allow an attacker with local access to extract stored p...

EUVD-2025-206308

Use of a Broken or Risky Cryptographic Algorithm DES vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brute Forcing to obtain database credentials.This issue affects ImageDirector Capture: from 7.0.9.0 before 7.6.3.25808...