CVE-2026-102206: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-100225: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-108468: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-102231: Improper Resolution of Path Equivalence

Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-109523: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

CVE-2026-109409: Improper Neutralization of Special Elements used in a Command

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

CVE-2026-109190: Server-Side Request Forgery (SSRF)

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be...

CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...

CVE-2026-18318: Improper Restriction of Excessive Authentication Attempts

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...

CVE-2026-79715: Improper Limitation of a Pathname to a Restricted Directory

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory...

CVE-2026-63161: Session Fixation

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-97811: Double Free

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-96926: Missing Authorization

Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...

CVE-2026-96843: Heap-based Buffer Overflow

Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-96847: Untrusted Pointer Dereference

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-96850: Use of Uninitialized Resource

Use of uninitialized resource in Windows Modern Device Management MDM allows an authorized attacker to disclose information locally...

CVE-2026-96206: Use of Uninitialized Resource

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally...

CVE-2026-96188: External Control of System or Configuration Setting

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally...

CVE-2026-96044: Improper Validation of Specified Type of Input

No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70214: Out-of-bounds Read

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...