CVE-2026-109149: Memory Allocation with Excessive Size Value

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...

CVE-2026-18318: Improper Restriction of Excessive Authentication Attempts

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...

CVE-2026-79715: Improper Limitation of a Pathname to a Restricted Directory

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory...

CVE-2026-63161: Session Fixation

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-97811: Double Free

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-96926: Missing Authorization

Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...

CVE-2026-96843: Heap-based Buffer Overflow

Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-96847: Untrusted Pointer Dereference

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-96850: Use of Uninitialized Resource

Use of uninitialized resource in Windows Modern Device Management MDM allows an authorized attacker to disclose information locally...

CVE-2026-96206: Use of Uninitialized Resource

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally...

CVE-2026-96188: External Control of System or Configuration Setting

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally...

CVE-2026-96044: Improper Validation of Specified Type of Input

No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70214: Out-of-bounds Read

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-69919: Out-of-bounds Read

Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally...

CVE-2026-70160: Use After Free

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-69902: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally...

CVE-2026-87694: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-83925: Use of Uninitialized Resource

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally...

CVE-2026-83907: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally...