Microsoft Windows: CVE-2026-70024: Windows Internet Information Services Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network...

PT-2026-113288

Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation o...

CVE-2026-103966: Heap-based Buffer Overflow

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Microsoft Windows: CVE-2026-83836: Windows Event Tracing Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally...

PT-2026-112704

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A heap-based buffer overflow exists in the Remote Access Point-to-Point Protocol PPP EAP-TLS. This flaw allows an unauthorized attacker to execute arbitrary code over a network. A...

PT-2026-113457

Name of the Vulnerable Software and Affected Versions Photoshop Desktop affected versions not specified Description An integer overflow or wraparound occurs during the parsing of DCM pixel data. This issue can lead to arbitrary code execution within the context of the current user, provided the...

PT-2026-111566

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.3.0 through 4.14.7 Description A remote code execution issue exists where the trust for Security Configuration Assessment SCA policies is determined by the file path instead of the configuration source. An attacker with contro...

CVE-2026-95121

An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType in src/atomrtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction...

CVE-2026-110111: Improperly Controlled Modification of Object Prototype Attributes

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-108381: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a...

PT-2026-111818

Name of the Vulnerable Software and Affected Versions Shopware version 6.7 Description Shopware allows the upload of attacker-controlled HTML files which are served as text/html without effective security headers, such as Content-Security-Policy or X-Content-Type-Options: nosniff. This leads to...

PT-2026-111942

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network...

PT-2026-111135

Name of the Vulnerable Software and Affected Versions SAP S/4HANA affected versions not specified Description Insufficient input validation in the rule definition functionality, which uses a domain-specific scripting language, allows an authenticated attacker with specific business privileges to...

PT-2026-112979

Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-69958: Windows Overlay Filter Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack...

CVE-2026-100127: Out-of-bounds Write

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-112602

Name of the Vulnerable Software and Affected Versions Windows Event Tracing affected versions not specified Description A heap-based buffer overflow occurs in Windows Event Tracing, which is a mechanism for logging system events. This flaw allows an unauthorized attacker to execute arbitrary code...

CVE-2026-106173: Improper Limitation of a Pathname to a Restricted Directory

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...

Microsoft Office: CVE-2026-70256: Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

VulnCheck KEV: CVE-2026-4883

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetformsajaxformbuilder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, a...