4937 matches found
PT-2026-40155
Name of the Vulnerable Software and Affected Versions Windows DWM Core Library affected versions not specified Description A buffer over-read in the Windows DWM Core Library allows an authorized attacker to disclose sensitive information locally. Recommendations At the moment, there is no...
CVE-2026-26270
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability exists in InvoicePlane latest version that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into...
User Impersonation
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation in the Telegram allowlist authorization. An attacker can gain unauthorized access by registering or taking over a previously authorized @username and interacting with t...
PT-2026-23538
Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.2.14 Description The OpenClaw exec-approvals allowlist validation checks tokens before expansion, but execution uses shell expansion. This allows safe binaries like head, tail, or grep to read arbitrary local...
CVE-2026-26119
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-26119
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
OMNI-STRIKE Multi‑Protocol Wireless Security Testing Platform
OMNI‑STRIKE is a multi‑protocol wireless security assessment application built for Flipper Zero. It is designed to discover nearby wireless devices and perform controlled, authorized security testing in a structured and logged environment...
Neo4j < 5.26.21 Information Disclosure Vulnerability (CVE-2026-1622)
According to its self-reported version number, the version of Neo4j running on the remote host is a version prior to 5.26.21. It is, therefore, affected by a information disclosure vulnerability where The obfuscateliterals option in the query logs does not redact error information, exposing...
Exploit for CVE-2025-49132
CVE-2025-49132PoC Pterodactyl Panel 1.11.11 - Remote Code Exe...
CVE-2026-21529
Improper neutralization of input during web page generation 'cross-site scripting' in Azure HDInsights allows an authorized attacker to perform spoofing over a network...
CVE-2026-25613
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index...
CVE-2026-25610
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints...
CVE-2026-21235
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...
CVE-2026-21244
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally...
CVE-2026-21523
Time-of-check time-of-use toctou race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network...
CVE-2026-21239
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-21255
Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally...
CVE-2026-21246
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...