CVE-2026-61844: Use of Incorrectly-Resolved Name or Reference

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share on...

CVE-2026-70096

Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network...

CVE-2026-70093

Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

CVE-2026-70093

A heap-based buffer overflow exists in the Windows Rich Text Edit Control . This vulnerability allows an authorized attacker to achieve local privilege elevation . No specific exploit information or workaround details are provided in the documents.

CVE-2026-70096

A heap-based buffer overflow exists in the Windows Rich Text Edit Control , which could allow an unauthorized attacker to achieve Remote Code Execution (RCE) over a network. This vulnerability is rated with a CRITICAL CVSS score of 9.8 . Microsoft has released official updates to address this iss...

CVE-2026-110098

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-110098 Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-110098 Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-110098

Versions of Jorani prior to 1.0.4 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The root cause is that the system authorizes actions based only on the operation name, failing to properly validate ownership of the request. Authenticated users can supply numeric reques...

CVE-2026-110098

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

Windows Rich Text Edit Control Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network...

Windows Rich Text Edit Control Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

CVE-2026-110098: Authorization Bypass Through User-Controlled Key

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

PT-2026-111280

Name of the Vulnerable Software and Affected Versions SourceCodester Performance Indicator System version 1.0 Description A security flaw allows remote attackers to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. The issue exists...

CVE-2026-70096: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-70093: Windows Rich Text Edit Control Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70096: Windows Rich Text Edit Control Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network...

CVE-2026-70093: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the...

CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the...