195501 matches found
CVE-2026-50348
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50330
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50326
Use after free in Windows Unified Consent System allows an authorized attacker to elevate privileges locally...
CVE-2026-50315
Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...
CVE-2026-15747
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...
CVE-2026-5040
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...
CVE-2026-5040
The CVE-2026-5040 entry applies to TP-Link Deco M5 v1. The issue stems from a weak password hashing mechanism used to store user credentials. An attacker who obtains the password hash via system compromise or privileged access could perform brute-force or dictionary attacks. Practical consequence...
Malicious code in chain-sdk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb94ce743d92fe81015db70380ba325e78e4271b78689a9a6998cda4e6bdc038 chain-sdk-js is a typosquat of @thetalabs/theta-js package name, description, author 'Theta Labs', and bundle filenames thetajs.cjs.js/thetajs.umd.js...
CVE-2026-45077 Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener Symfony\Bridge\Monolog\Command\ServerLogCommand binds to 0.0.0.0:9911 by default and processes each received frame with...
CVE-2026-15757 Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router
A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has n...
CVE-2026-57976
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...
CVE-2026-57097
Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack...
CVE-2026-56169
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-55014
Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally...
CVE-2026-54995
Use after free in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over a network...
CVE-2026-54996
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Print Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-54132
Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack...
CVE-2026-50695
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network...