CVE-2026-6265

CVE-2026-6265 is a local privilege escalation in Cerberus FTP Server on Windows due to insecure preserved inherited permissions. The issue affects Cerberus FTP Server versions up to and including 2025.4.2 and is resolved in version 2026.1. The CVSS-derived metrics indicate a high impact with loca...

PT-2026-47474

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.103 Description A use after free issue exists in FullScreen on Windows, which could allow a remote attacker to potentially exploit heap corruption through a crafted HTML page. Use after free is a...

Foxit PDF Editor < 14.0.4 / 2026.1.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2026.1.1/14.0.4. It is, therefore affected by multiple vulnerabilities: - Document structural anomalies caused inconsistencies between page element...

CVE-2026-41527

A flaw was found in KDE Kleopatra on Windows. A local user could exploit an error in the KUniqueService mechanism, which is responsible for ensuring only one instance of the application runs. This vulnerability allows the local user to obtain the privileges of an existing Kleopatra user, leading ...

DEBIAN-CVE-2026-6921

Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. Chromium security severity: Medium...

Exploit for CVE-2017-0144

No d...

Exploit for CVE-2017-0144

No d...

📄 Remote Sunrise Helper for Windows 2026.14 Directory Creation

Remote Sunrise Helper for Windows version 2026.14 suffers from an unauthenticated directory creation vulnerability. !/usr/bin/env python3 Exploit Title: Remote Sunrise Helper for Windows 2026.14 - Unauthenticated Directory Creation Date: 2026-04-20 Exploit Author: Chokri Hammedi Software:...

SUSE CVE-2026-6359

Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

PT-2026-33510

On Windows, Claude Code loaded system-wide default configuration from C:ProgramDataClaudeCodemanaged-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory was...

The vulnerability of the Transport Driver Interface (TDI) driver in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Transport Driver Interface TDI driver in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2026-26155

Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability...

CVE-2026-27916

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

CVE-2026-27917

Use after free in Windows WFP NDIS Lightweight Filter Driver wfplwfs.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-6359

Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

PowerShell Command Injection in Podman HyperV Machine

Summary A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $ subexpression injection. Affected Code File: pkg/machine/hyperv/stubber.go:647 go resize :=...

EUVD-2026-22463

Untrusted pointer dereference in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

CVE-2026-32156

Use after free in Windows Universal Plug and Play UPnP Device Host allows an unauthorized attacker to execute code locally...

CVE-2026-27929

Time-of-check time-of-use toctou race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally...

CVE-2026-33824

CVE-2026-33824 is a Windows IKE Extension (ikeext) remote code execution vulnerability caused by a double-free in IKEEXT. ZDI notes it is wormable and affects systems with IKE enabled; exploitation can occur over UDP/500-4500 and may enable lateral movement from inside networks. Microsoft has iss...