3039 matches found
CVE-2026-69777
Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network...
CVE-2026-68786
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
CVE-2026-67642
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
CVE-2026-54611
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...
CVE-2026-54611 InstantCMS has Remote Code Execution in package installer
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...
CVE-2026-54611 InstantCMS has Remote Code Execution in package installer
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...
CVE-2026-69478
CVE-2026-69478 is a heap-based buffer overflow in the Windows Device Association Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impact ...
EUVD-2026-73418
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network...
EUVD-2026-73351
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69681
CVE-2026-69681 is a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low privi...
CVE-2026-69572
CVE-2026-69572 is an out-of-bounds read vulnerability in the Windows SMB Client that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 score is 5.7 (Medium) with vector AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low req...
CVE-2026-69436
CVE-2026-69436 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker with low privileges to escalate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impact across confidentiality, i...
CVE-2026-12646
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12648
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12647
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12645
CVE-2026-12645 is a Missing Authorization vulnerability in Ivanti Neurons for ITSM affecting versions before 2026.2 . A remote authenticated attacker can leverage this flaw to execute arbitrary code on the server, with the scope changed and high impact on confidentiality, integrity, and availabil...
Microsoft Office SharePoint Information Disclosure Vulnerability
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
PT-2026-87033
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...
PT-2026-87084
Name of the Vulnerable Software and Affected Versions Ivanti Neurons for ITSM versions prior to 2026.2 Description A missing authorization issue allows a remote authenticated attacker to execute arbitrary code on the server. Recommendations At the moment, there is no information about a newer...