CVE-2026-70071: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally...

CVE-2026-96314: Out-of-bounds Read

Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-103554: Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-109156: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...

CVE-2026-96044: Improper Validation of Specified Type of Input

No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-109526: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used...

CVE-2026-87695: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83504: Windows SmartScreen Information Disclosure Vulnerability

Time-of-check time-of-use toctou race condition in Windows SmartScreen allows an authorized attacker to disclose information locally...

CVE-2026-70161

Improper limitation of a pathname to a restricted directory 'path traversal' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96231

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-70197

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network...

CVE-2026-70190

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96225

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-83504: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check time-of-use toctou race condition in Windows SmartScreen allows an authorized attacker to disclose information locally...

CVE-2026-108959: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-18318: Improper Restriction of Excessive Authentication Attempts

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...

PT-2026-116155

🚨 CVE-2026-108576 A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was...

CVE-2026-70067: Use After Free

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

PT-2026-111408

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-432BRP version 3.10B20 Description A stack-based buffer overflow occurs when manipulating the Name argument within the formTcpipSetup function located in the /goform/formTcpipSetup file. This issue allows a remote attacker to...

PT-2026-111405

Name of the Vulnerable Software and Affected Versions MosaicML Composer versions prior to 0.32.2 Description A path traversal issue exists in the Checkpoint Extraction component within the tarball.extractall function of the composer/utils/checkpoint.py file. This flaw allows a remote attacker to...