CVE-2026-102206: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-109160: URL Redirection to Untrusted Site

A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the...

PT-2026-111675

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save user of the file admin/admin class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remot...

SUSE SLES15 Security Update : unbound (SUSE-SU-2026:4624-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4624-1 advisory. - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. - CVE-2026-77955: Possible ZONEMD verification bypass...

PT-2026-111208

Name of the Vulnerable Software and Affected Versions TensorLayer versions prior to 2.2.5 Description An issue exists in the HDF5 Loading component within the load hdf5 graph function of the tensorlayer/files/utils.py file. A remote attacker can manipulate the model config argument to trigger...

PT-2026-111419

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

Microsoft Exchange: CVE-2026-87692: Microsoft Exchange Server Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83706: Windows NTFS Elevation of Privilege Vulnerability

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-105729: Untrusted Pointer Dereference

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally...

Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills

Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them. Installing one grants authority the standing to direct the agent, not new privilege, and the size of that grant is what we measure. We present a...

CVE-2026-109157: Stack-based Buffer Overflow

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2026-108945: Improper Control of Generation of Code

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kptshape results...

PT-2026-113185

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

Microsoft SQL Server: CVE-2026-88088: Microsoft SQL Server Elevation of Privilege Vulnerability

Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally...

PT-2026-112442

Name of the Vulnerable Software and Affected Versions Windows Resilient File System ReFS Deduplication Service affected versions not specified Description Weak authentication in the Windows Resilient File System ReFS Deduplication Service allows an authorized attacker to elevate privileges locall...

PT-2026-112431

Name of the Vulnerable Software and Affected Versions Windows Audio Service affected versions not specified Description A null pointer dereference in the Windows Audio Service allows an authorized attacker to disclose sensitive information locally and affect the system. A null pointer dereference...

PT-2026-112749

Name of the Vulnerable Software and Affected Versions Windows Hyper-V affected versions not specified Description An out-of-bounds read occurs in Windows Hyper-V, which allows an authorized attacker to elevate privileges locally and affect the system. An out-of-bounds read is a condition where a...

CVE-2026-83573: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-88139: Use After Free

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

VulnCheck KEV: CVE-2026-104935

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands...