CVE-2026-69572

CVE-2026-69572 is an out-of-bounds read vulnerability in the Windows SMB Client that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 score is 5.7 (Medium) with vector AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low req...

CVE-2026-69436

CVE-2026-69436 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker with low privileges to escalate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impact across confidentiality, i...

CVE-2026-12646

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12648

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12647

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12645

CVE-2026-12645 is a Missing Authorization vulnerability in Ivanti Neurons for ITSM affecting versions before 2026.2 . A remote authenticated attacker can leverage this flaw to execute arbitrary code on the server, with the scope changed and high impact on confidentiality, integrity, and availabil...

Microsoft Office SharePoint Information Disclosure Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

PT-2026-87506

Name of the Vulnerable Software and Affected Versions Windows Enterprise App Management affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. This issue allows an...

CVE-2026-73321: Uncontrolled Recursion

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-12645: Missing Authorization

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

PT-2026-88131

🚨 CVE-2026-83983 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. 🎖@cveNotify...

PT-2026-87084

Name of the Vulnerable Software and Affected Versions Ivanti Neurons for ITSM versions prior to 2026.2 Description A missing authorization issue allows a remote authenticated attacker to execute arbitrary code on the server. Recommendations At the moment, there is no information about a newer...

PT-2026-87033

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

PT-2026-87247

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

PT-2026-87192

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-12647: Missing Authorization

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

PT-2026-87092

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile versions prior to 12.10.0.0 Ivanti Endpoint Manager Mobile versions prior to 12.9.0.2 Ivanti Endpoint Manager Mobile versions prior to 12.8.0.4 Description A missing authorization issue allows a remote...

CVE-2026-33388: Incorrect Authorization

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

CVE-2026-54611: Improper Control of Generation of Code

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

AZL-99980 CVE-2026-18355 affecting package 389-ds-base 3.1.1-12

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...