35183 matches found
Windows Notepad App Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Windows Notepad App allows an unauthorized attacker to execute code locally...
CVE-2026-25656
creationtimestamp| type| source ---|---|--- 2026-02-10 10:31:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meir2en3ge2h 2026-02-12 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-01 2026-02-17 18:54:30+00:00| seen|...
Malicious code in devtools-webhook-cicd-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 807557cb6ac51aece00eeb28f55b89815176c95172780dcdded46b667f843771 During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and...
CVE-2026-23688
SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...
CVE-2026-23688 Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)
SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...
CVE-2026-23688 Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)
SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...
[SECURITY] Fedora 43 Update: rust-app-store-connect-0.5.0-6.fc43
Apple App Store Connect API and client...
PT-2026-7469
Name of the Vulnerable Software and Affected Versions ZOLL ePCR IOS application affected versions not specified Description The application displays user-supplied data within a WebView without proper sanitization. Specifically, attacker-controlled strings entered into PCR fields such as run numbe...
CVE-2026-21517: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Windows App for Mac allows an authorized attacker to elevate privileges locally...
CVE-2026-23688: Missing Authorization
SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...
CVE-2026-20841: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Windows Notepad App allows an unauthorized attacker to execute code locally...
PT-2026-7402
Name of the Vulnerable Software and Affected Versions Windows App for Mac affected versions not specified Description A flaw in how the Windows App for Mac handles link resolution before file access, known as 'link following', could allow a local attacker to gain higher privileges. The issue was...
CVE-2026-25925
PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...
CVE-2026-25925
PowerDocu (Windows GUI) is vulnerable before version 2.4.0 due to JSON deserialization in Flow/App packages. The app blindly trusts the $type property, allowing an attacker to instantiate arbitrary .NET objects and execute code. This yields high-severity, local, with user interaction required. Fi...
CVE-2026-25925
PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...
CVE-2026-24900
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...
CVE-2026-25057
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...
CVE-2026-25057
CVE-2026-25057 affects MarkUs prior to version 2.9.1. Instructors can upload a zip file to create an assignment from an exported configuration, and the zip entry names are used to construct paths for writing files to disk without validating those paths. This can allow arbitrary path usage during ...
CVE-2026-24900
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...
