CVE-2026-88134: Use After Free

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-102192: Windows Failover Cluster Denial of Service Vulnerability

Integer underflow wrap or wraparound in Windows Failover Cluster allows an unauthorized attacker to deny service over a network...

CVE-2026-95695: Incorrect Authorization

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization...

Microsoft Windows: CVE-2026-69967: Windows Overlay Filter Information Disclosure Vulnerability

Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-103554: Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-109519: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The...

CVE-2026-85835: Buffer Over-read

Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally...

PT-2026-111126

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt shape result...

PT-2026-111274

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage. init of the file paddlex/inference/models/text detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is...

PT-2026-111135

Name of the Vulnerable Software and Affected Versions SAP S/4HANA affected versions not specified Description Insufficient input validation in the rule definition functionality, which uses a domain-specific scripting language, allows an authenticated attacker with specific business privileges to...

PT-2026-111164

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn functions.php of the component User Profile Update Handler. The manipulation of the argument usertype id leads to...

PT-2026-113240

Name of the Vulnerable Software and Affected Versions OpenSSH for Windows affected versions not specified Description A double free issue exists that allows an authorized attacker to elevate privileges locally. A double free occurs when the program attempts to free the same memory location twice,...

PT-2026-113117

Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...

CVE-2026-110237: Unverified Ownership

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-109966: Improper Neutralization of Argument Delimiters in a Command

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-110036: Integer Overflow or Wraparound

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

CVE-2026-100200: Use After Free

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

CVE-2026-102191: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-102206: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack...