57752 matches found
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck
Summary The OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience aud claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia...
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
Summary The YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the msg or callback fields. On the client side, plugin/YPTSocket/script.js contains two eval sinks fed directly by those relayed fields...
GHSA-GPH2-J4C9-VHHR WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
Summary The YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the msg or callback fields. On the client side, plugin/YPTSocket/script.js contains two eval sinks fed directly by those relayed fields...
Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
Microsoft has released its monthly security update for April 2026, which includes 165 vulnerabilities affecting a wide range of products, including eight Microsoft marked as "critical." CVE-2026-23666 is a critical Denial of Service DoS vulnerability that affects the .NET framework. Successful...
EUVD-2026-22545
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
EUVD-2026-22414
Heap-based buffer overflow in Windows Client Side Caching driver csc.sys allows an authorized attacker to elevate privileges locally...
EUVD-2026-22333
A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection...
CVE-2026-32157
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
CVE-2026-26176
Heap-based buffer overflow in Windows Client Side Caching driver csc.sys allows an authorized attacker to elevate privileges locally...
2026-04 .NET 10.0.6 Security Update for x64 Client (KB5086095)
2026-04 .NET 10.0.6 Security Update for x64 Client KB5086095...
2026-04 .NET 10.0.6 Security Update for x86 Client (KB5086095)
2026-04 .NET 10.0.6 Security Update for x86 Client KB5086095...
2026-04 .NET 8.0.26 Security Update for x64 Client (KB5086096)
2026-04 .NET 8.0.26 Security Update for x64 Client KB5086096...
2026-04 .NET 8.0.26 Security Update for x86 Client (KB5086096)
2026-04 .NET 8.0.26 Security Update for x86 Client KB5086096...
2026-04 .NET 9.0.15 Security Update for x64 Client (KB5086097)
2026-04 .NET 9.0.15 Security Update for x64 Client KB5086097...
CVE-2026-26176 Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability
...
CVE-2026-26176 Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability
...
CVE-2026-26176
Technical details about CVE-2026-26176 are not provided in the supplied documents. Monitor for updates from Microsoft Security Update Guide and CVE records for affected specifics, impact, and remediation.
CVE-2026-32157
CVE-2026-32157 affects the Remote Desktop Client and enables remote code execution over the network. The CVSSv3.1 score is 8.8 (HIGH), with confidentiality, integrity, and availability all rated High. Attack requires network access and user interaction, with privilegesN/A and exploitation current...
