CVE-2026-100706

A flaw was found in Kyverno. An authenticated user with namespace-level permissions can achieve privilege escalation to cluster administrator by supplying encoded path traversal sequences within policy requests. This vulnerability allows an attacker to bypass namespace isolation controls and crea...

CVE-2026-63148

The Omnispace Agora Project (versions before 26.10.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated attackers can bypass the paramFilter sanitization applied to ** extsubscript{$_FILES}** by uploading a poll-response attachment with a malicious filename. This crafted f...

CVE-2023-35793-CSRF-On-Web-SSH

CVE-2023-35793-CSRF-On-Web-SSH Repository contains description for CVE-2023-35793 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-35793 Vendor: Cassia Networks Product: Access Controller Version: Cassia-AC-2.1.1.2303271039 Vulnerability: Cross Site Request Forgery...

CVE-2026-88143

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

CVE-2026-88100

Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

CVE-2026-87716

Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network...

CVE-2026-87706

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

CVE-2026-70238

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

CVE-2026-88143

A heap-based buffer overflow exists in the Windows Storage Spaces Controller . This vulnerability allows an authorized attacker to perform a local privilege escalation . The technical root cause is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-191 (Integer Underflow). No specific e...

CVE-2026-88100

A Use after free vulnerability exists in the Windows Storage Spaces Controller . This flaw allows an authorized attacker to achieve local privilege escalation . While the vulnerability is confirmed with a CVSSv3.1 base score of 7.8 , no specific exploit details or in-the-wild exploitation reports...

CVE-2026-87716

A heap-based buffer overflow vulnerability exists in the Windows Storage Spaces Controller . This flaw allows an unauthorized attacker to perform a denial of service (DoS) attack over a network. The CVSS 3.1 score of 7.5 (High) reflects an attack vector that requires no privileges or user interac...

CVE-2026-87706

A heap-based buffer overflow vulnerability exists in the Windows Storage Spaces Controller . This flaw allows an authorized attacker to achieve local privilege escalation . The vulnerability has a HIGH severity score of 7.8. No specific version numbers, exploit links, or detailed remediation step...

CVE-2026-70238

A heap-based buffer overflow exists in the Windows Storage Spaces Controller . This vulnerability allows an authorized attacker to achieve local privilege elevation . No specific version numbers, underlying code files, or remediation steps are provided in the documents. Exploitation details are n...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

CVE-2026-77459

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitt...

CVE-2026-110099

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/id and hr/exportOvertime/id to downloa...

CVE-2026-110099

The Jorani application (versions before 1.0.4 ) is susceptible to a missing authorization vulnerability within the Hr controller . Specifically, the exportLeaves, exportOvertime, and exportEmployees actions do not properly restrict access, allowing any authenticated user to export sensitive HR da...

CVE-2026-110099

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/id and hr/exportOvertime/id to downloa...