PT-2026-113031

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally...

PT-2026-111525

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

CyberArena: Benchmarking AI Agents in Live Symmetric Attack-And-Defense Combat

AI agents are demonstrating increasingly strong offensive and defensive cybersecurity capabilities in the real world. Current benchmarks mostly evaluate agents in isolation against static targets. Real cyber operations, however, are dynamic and coupled: security postures constantly change as...

CVE-2026-97798: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in a command 'argument injection' in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-97798: Windows Error Reporting Service Elevation of Privilege Vulnerability

Improper neutralization of argument delimiters in a command 'argument injection' in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

PT-2026-112658

Name of the Vulnerable Software and Affected Versions Windows Win32 Kernel Subsystem affected versions not specified Description An issue in the Windows Win32 Kernel Subsystem allows an authorized attacker to locally disclose sensitive system information to an unauthorized control sphere...

PT-2026-113136

Name of the Vulnerable Software and Affected Versions Windows Universal Disk Format File System Driver UDFS affected versions not specified Description An out-of-bounds read in the Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to disclose sensitive informatio...

PT-2026-113137

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, the...

PT-2026-112349

Name of the Vulnerable Software and Affected Versions Microsoft Trace Data Helper affected versions not specified Description An issue in Microsoft Trace Data Helper allows an authorized attacker to locally disclose sensitive system information to an unauthorized control sphere. Recommendations A...

CVE-2026-85935: Buffer Over-read

Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-108134: Windows Autopilot Elevation of Privilege Vulnerability

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally...

PT-2026-111274

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage. init of the file paddlex/inference/models/text detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is...

CVE-2026-108130: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...

CVE-2026-85876: Use After Free

Use after free in SQL Server allows an authorized attacker to elevate privileges locally...

CVE-2026-110237: Unverified Ownership

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-109116: Authorization Bypass Through User-Controlled Key

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqliquery of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be...

PT-2026-111126

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt shape result...

CVE-2026-108941: Improper Control of Generation of Code

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-70264: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Microsoft Defender allows an authorized attacker to disclose information locally...

CVE-2026-85900: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...