PT-2026-97512

Name of the Vulnerable Software and Affected Versions Easy Store extension versions 1.0.0 through 3.0.0 Description The product review submission endpoint 'index.php?option=com easystore&task=product.addReview' fails to verify anti-CSRF tokens because the check was commented out in the code. This...

PT-2026-97514

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...

Windows Exploitation Techniques: Dangling COM Object Registrations

Posted by James Forshaw This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug wa...

PT-2026-95908

Name of the Vulnerable Software and Affected Versions Dromara UJCMS versions prior to 12.3.2 Description An improper authorization issue exists in the UserController component. A remote attacker can manipulate the Username variable within the usernameExist function of the...

CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-69299

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-69294

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

CVE-2026-69294

Microsoft COM for Windows is affected by an information disclosure vulnerability caused by the generation of an error message containing sensitive information. An authorized local attacker can exploit this to disclose information, with no user interaction required. The CVSS 3.1 score is 5.5 (Medi...

EUVD-2026-73439

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

EUVD-2026-73434

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-69299

Microsoft COM for Windows is affected by a use-after-free vulnerability that allows an authorized local attacker to achieve privilege escalation. The CVSS 3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, and low required privileges. No user interaction is needed, and all thr...

Microsoft COM for Windows Elevation of Privilege Vulnerability

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

Microsoft COM for Windows Information Disclosure Vulnerability

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

PT-2026-87346

Name of the Vulnerable Software and Affected Versions Microsoft COM for Windows affected versions not specified Description A use-after-free condition in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs...

CVE-2026-69294: Generation of Error Message Containing Sensitive Information

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

PT-2026-87341

Name of the Vulnerable Software and Affected Versions Microsoft COM for Windows affected versions not specified Description An issue in Microsoft COM for Windows allows an authorized attacker to locally disclose sensitive information through the generation of error messages. Recommendations At th...

CVE-2026-69299: Use After Free

Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally...

The vulnerability of the Silabs CP210x VCP virtual COM port driver lies in its uncontrolled search path, which allows attackers to escalate their privileges and execute arbitrary code.

The vulnerability of the Silabs CP210x VCP virtual COM port driver is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary code...

CVE-2026-48554

CVE-2026-48554 affects Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7). An authenticated remote code execution flaw exists via unfiltered NOTIFICATION-family macro substitution in the com_data parameter. If a notification command uses $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

CVE-2026-57105

creationtimestamp| type| source ---|---|--- 2026-08-11 19:01:11+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 22:01:22+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0286 2026-08-12 01:01:07+00:00| seen|...