EUVD-2026-56308

Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-59128

Out-of-bounds read in Windows Encrypting File System EFS allows an authorized attacker to disclose information locally...

EUVD-2026-56309

Out-of-bounds read in Windows Encrypting File System EFS allows an authorized attacker to disclose information locally...

CVE-2026-47285

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

EUVD-2026-56302

Improper neutralization of special elements used in a command 'command injection' in Windows Active Directory allows an unauthorized attacker to execute code over a network...

CVE-2026-54984

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally...

CVE-2026-49179

Improper neutralization of special elements used in a command 'command injection' in Windows Active Directory allows an unauthorized attacker to execute code over a network...

EUVD-2026-56298

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

EUVD-2026-56294

Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

EUVD-2026-56291

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56288

Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally...

CVE-2025-61970

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

CVE-2026-68253

A flaw was found in the Linux kernel's drm/i915/hdcp component, which handles display-related operations. This vulnerability arises because a check for buffer overflow is performed after the overflow has already occurred during a write operation. This improper handling of memory boundaries can le...

CVE-2026-68275

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker, with the ability to issue ioctl commands to the render group, could trigger a null pointer dereference by requesting mapping information for an unmapped buffer object. This could lead to a system crash, resulting ...

CVE-2026-68208

A flaw was found in the Linux kernel's media subsystem ti: vpe. An incorrect error check in the vipprobeslice function, specifically when handling memory allocation failures from devmkzalloc, could lead to a denial of service. A local attacker could potentially exploit this to cause system...

CVE-2026-68380

A flaw was found in the Linux kernel's AMD XDNA accelerator driver. The amdxdnacmdsubmit function improperly handles references to the mmstruct when scheduling jobs. This can lead to a use-after-free vulnerability, where the mmstruct is deallocated before the job scheduler can access it. A local...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service DoS condition where legitima...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

EUVD-2026-56552

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...