CVE-2026-21399

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

EUVD-2026-56515

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-21399

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-21399

The CVE affects Intel Open Volume Kernel Library (Intel Open VKL) prior to version 2.0.2, with a heap-based buffer overflow in the library component. The issue occurs in Ring 3 (user applications) and can allow a Denial of Service when an authenticated local user with low attack complexity can tr...

CVE-2026-20786

CVE-2026-20786 describes an out-of-bounds read in the Intel(R) NPU Driver affecting all Ring 3 (user) versions. An unprivileged authenticated user with local access and low attack complexity may cause denial of service, with potential impact on integrity (low) and availability (high); confidentia...

CVE-2026-9214

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-53416

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...

CVE-2026-18640

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

CVE-2026-11738

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-11735

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...

CVE-2026-11736

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

CVE-2026-11737

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

CVE-2026-11734

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...

CVE-2026-53416

CVE-2026-53416 affects the Zoom VDI Client and Plugins. The issue is a path traversal vulnerability that may allow an authenticated user to disclose information via local access. Root cause is path traversal in the affected components. Exploitation details are not provided in the documents. The C...

EUVD-2026-56246

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...

CVE-2026-53416 Zoom VDI - Path Traversal

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...

CVE-2026-73079 Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

CVE-2026-73079

CVE-2026-73079 affects Sub2API, an AI API gateway for distributing quota and managing AI subscriptions. From versions 0.1.135 through 0.1.168, API keys issued to tenants could be exchanged for upstream requests using shared provider accounts (operator-owned credentials), allowing an authenticated...

CVE-2026-73079 Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

EUVD-2026-56236

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...