CVE-2026-86740: Improper Removal of Sensitive Information Before Storage or Transfer

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

EUVD-2026-67928

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads...

EUVD-2026-69706

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path...

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...

CVE-2026-69541

Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-81355: Heap-based Buffer Overflow

Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to execute code locally...

CVE-2026-69611: Use After Free

Use after free in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69549: Out-of-bounds Read

Out-of-bounds read in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69592: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69573: Use After Free

Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69758: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69681: Heap-based Buffer Overflow

Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges over a network...

CVE-2026-69384: NULL Pointer Dereference

Null pointer dereference in Virtual Hard Disk VHD Miniport Driver allows an unauthorized attacker to deny service locally...

CVE-2026-70574: Out-of-bounds Read

Out-of-bounds read in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69541: Heap-based Buffer Overflow

Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

BIT-ELASTICSEARCH-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2026-86347

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86347

MISP is affected by a missing authorization flaw in the TemplatesController::uploadFile() action. The ACL entry for templates/uploadFile used the wildcard * instead of the intended perm_add role restriction, allowing any authenticated user—including low-privileged or read-only users—to repeatedly...

CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...