34076 matches found
CVE-2026-71333
CVE-2026-71333 is a use-after-free vulnerability in Windows Remote Access Connection Manager that allows an authorized local attacker with low privileges to escalate privileges. The attack requires high complexity, no user interaction, and has a CVSS 3.1 score of 7.0 (HIGH) with high impact on co...
CVE-2026-69455
CVE-2026-69455 is a heap-based buffer overflow in Windows Remote Access Connection Manager that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low complexity, and low required privileges, resulting in high impact ...
CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...
CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...
CVE-2026-82075
CVE-2026-82075 is an uncontrolled resource consumption vulnerability in the request-handling path of the MongoDB sharded-cluster router process. An unauthenticated client with network access to a router port can supply connection-monitoring parameters that cause the server to expend CPU without r...
CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...
EUVD-2026-72940
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...
Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...
CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers
In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Use after free in Windows Internet Connection Sharing ICS allows an authorized attacker to elevate privileges locally...
Windows Network Connection Broker Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...
Windows Remote Access Connection Manager Tampering Vulnerability
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...
Windows Network Connection Broker Information Disclosure Vulnerability
Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...