CVE-2026-106587

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

CVE-2026-70165

A flaw was found in .NET. An authorized local attacker could exploit this vulnerability to achieve privilege escalation on the host system. The issue is caused by improper link resolution before file access, where the application fails to properly validate file links. By manipulating these links,...

CVE-2026-66055

A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and...

CVE-2026-96225

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96231

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96236

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-55480

A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying wheth...

CVE-2026-88901

A flaw was found in the Apache Camel Smooks component camel-smooks. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting a crafted XML message containing external entity references. Because the component processes incoming XML data without...

EUVD-2026-104571

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be...

CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...

CVE-2026-112248

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated...

CVE-2026-112249 grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched...

CVE-2026-112249 grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched...

CVE-2026-91779

A flaw was found in GNU Binutils. A local attacker can trigger a null pointer dereference within the Eh Frame Handler component by performing a specific manipulation. This vulnerability can lead to a Denial of Service DoS, making the affected system or application unavailable...

CVE-2026-98530

A flaw was found in the Linux kernel's kprobes subsystem. A privileged local user could trigger improper synchronization when disabling or flushing probe optimization, causing the process to hang indefinitely while holding an internal lock. This issue can make administrative interfaces...

CVE-2026-91780

A flaw was found in GNU Binutils. A local attacker can trigger a null pointer dereference by manipulating input to the 'elflinkaddobjectsymbols' function. This can lead to a denial of service DoS condition, making the affected component unavailable...

CVE-2026-98529

A flaw was found in the Linux kernel's Arizona General Purpose Input/Output GPIO driver. This issue allows a local user to cause a resource leak by triggering an error during persistent GPIO line configuration. Specifically, if an internal register update fails while changing pin direction from...

CVE-2026-98460

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local, unprivileged user to bypass security restrictions and send unauthorized commands directly to the Bluetooth hardware. The vulnerability exists because the Host Controller Interface HCI raw socket improperly filte...

CVE-2026-98525

A flaw was found in the Linux kernel's Management Component Transport Protocol MCTP subsystem. When looking up preallocated communication tags, the kernel fails to verify that a requested tag belongs to the calling socket and instead searches across the entire network namespace. A local attacker...

CVE-2026-70007

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the target system over the network. By convincing a user to process specially crafted input, an attacker can trigger memory corruption and compromise the affected...