200484 matches found
CVE-2026-15698
CVE-2026-15698 affects kofrasa mingo up to 7.2.1. The vulnerability lies in the Update API’s functions update/updateOne/updateMany, where manipulating the Set argument can lead to prototype pollution of object attributes. The issue is exploitable remotely, and a fix is available in version 7.2.2 ...
CVE-2026-15698 kofrasa mingo Update API updateMany prototype pollution
A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched...
CVE-2026-59839
CVE-2026-59839 describes a path traversal vulnerability: improper limitation of a pathname to a restricted directory in Fortinet products, affecting FortiOS (versions 7.6.0–7.6.6, 7.4.0–7.4.9, 7.2.x, 7.0.x, 6.4.x), FortiPAM (1.8.0 down to 1.0, all 1.x releases), and FortiProxy (7.6.0–7.6.5, 7.4–7...
CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution
A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...
CVE-2026-15697
CVE-2026-15697 affects the svgdotjs svg.js library (up to v3.2.5). The vulnerability is in the EventTarget.on function, enabling manipulation that leads to improperly controlled modification of object prototype attributes (prototype pollution). It is described as exploitable remotely with a repor...
CVE-2026-55954
CVE-2026-55954 affects ueberauth_apple (v0.1.0 up to but not including v0.6.2). The root cause is lack of validation for registered ID token claims (iss, aud, exp, iat) in Ueberauth.Strategy.Apple.Token.payload/2; the code uses the unvalidated sub to derive the user uid and email. An attacker who...
CVE-2026-10670 User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier
The CONFIGUSERSPACE verification handler for the kthreadnamecopy system call zvrfykthreadnamecopy in kernel/thread.c calls kobjectfind on the caller-supplied thread pointer and then dereferences the returned struct kobject without checking it for NULL. kobjectfind returns NULL whenever the suppli...
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally...
Windows App Package Installer Elevation of Privilege Vulnerability
Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally...
Microsoft Windows App Store Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Store allows an unauthorized attacker to elevate privileges over a network...
Windows USB Print Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Print Driver allows an authorized attacker to elevate privileges locally...
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
Windows DHCP Client Elevation of Privilege Vulnerability
Integer underflow wrap or wraparound in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network...
Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...
Microsoft SharePoint Server Spoofing Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
Microsoft SharePoint Server Spoofing Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
Windows Kernel Elevation of Privilege Vulnerability
Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally...
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Resilient File System ReFS allows an unauthorized attacker to execute code with a physical attack...
Windows Graphics Component Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally...