EUVD-2026-73011

Improper neutralization of special elements used in a command 'command injection' in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

PT-2026-87867

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

PT-2026-88425

Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:ProgramDataMaono'. Fixed in 4.0.80...

CVE-2026-78043

A flaw was found in OpenVPN. The Windows Interactive Service allows local authenticated users to bypass security restrictions and load unauthorized configuration files. By crafting special paths, an attacker can manipulate the service's configuration, potentially leading to privilege escalation...

CVE-2026-78221

A flaw was found in OpenVPN. An incorrect buffer size calculation within the Windows Interactive Service allows local authenticated users to trigger memory corruption or disclose sensitive information. This vulnerability can be exploited by providing specially crafted inputs...

CVE-2026-81830

A flaw was found in OpenVPN. The Windows interactive service in OpenVPN contains an incorrect file path validation vulnerability. A local authenticated user could exploit this flaw to bypass the trusted configuration directory constraint, leading to a security bypass and potential integrity...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-78043

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

EUVD-2026-72279

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

OpenVPN versions 2.4.0 through 2.6.22 contain a vulnerability in the Windows interactive service caused by incorrect file path validation , allowing local authenticated users to bypass the trusted configuration directory constraint. The impact is primarily a security bypass with high integrity im...

CVE-2026-78221

An incorrect buffer size calculation in the Windows Interactive Service component of OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information by supplying crafted NRPT inputs . The CVSS 4.0 base score is 5.9 (MEDIUM) with a loc...

CVE-2026-78221

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs...

CVE-2026-78043

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

PT-2026-86639

The Windows Interactive Service in OpenVPN 2.7 alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

PT-2026-86643

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.6.22 Description The Windows interactive service contains a flaw in file path validation. This allows local authenticated users to bypass the constraint of the trusted configuration directory. Recommendations...

PT-2026-86640

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7 alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs...

Angry Birds: Toy Ghouls’ new toys

Introduction We continue tracking the activity of Toy Ghouls also known as Bearlyfy, Laboo.boo, and Feral Wolf, a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along...