CVE-2026-66005

CVE-2026-66005 affects Jan up to version 0.8.4. The local API server has a CORS misconfiguration that replaces user-configured trusted hosts with a wildcard, reflecting arbitrary origins with credentials. This enables network-adjacent attackers to bypass trusted host restrictions and reach the un...

PT-2026-64318

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

EUVD-2026-48396

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

CVE-2026-65698

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

Johnson Controls C-CURE 9000 and Victor application server

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds...

PT-2026-64176

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A NULL pointer dereference occurs in the MMS Write Named Variable List handler. A network adjacent attacker can cause the server to crash by sending a WriteReque...

UBUNTU-CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network...

CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

EUVD-2026-43878

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-44020

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-44015

Integer underflow wrap or wraparound in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-56181

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2026-50485

Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network...

CVE-2026-50426

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network...

CVE-2026-50365

Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-54999

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-54982

Integer underflow wrap or wraparound in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-47632

Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-42975

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-47632

Azure Monitor Agent Metrics Extension is affected by CVE-2026-47632 due to improper certificate validation, enabling elevation of privileges for an unauthenticated attacker on an adjacent network. Exploitation details are not provided in the connected documents. CVSSv3.1 base score 8.8 (High): AV...