67690 matches found
CVE-2026-61937 Windows HTTP.sys Elevation of Privilege Vulnerability
...
CVE-2026-48387
CVE-2026-48387 affects CAI Content Credentials and is caused by an integer overflow/wraparound that can crash the application, resulting in a denial-of-service. Exploitation is possible without user interaction and requires local access (per CVSS metrics: AV:L, AC:L, PR:N, UI:N, S:U, A:H). The co...
CVE-2026-48438
CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...
EUVD-2026-56542
ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction...
CVE-2026-48362
ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitatio...
AI Genie in the Wild
When I give talks about AI genies, I use this sort of example as a hypothetical. It's happened. The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And…. Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several wee...
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...
Microsoft Outlook Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...
Windows DNS Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network...
Win32k Information Disclosure Vulnerability
Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally...
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...
CVE-2026-72548
OpenSignLabs OpenSign (up to version 2.37.0) contains an information disclosure vulnerability in the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication/authorization checks, enabling unauthenticated remote attackers...
Exploit for CVE-2026-62737
CVE-2026-62737: from crash to lab-assisted SYSTEM A follow-up...
CVE-2026-5304
CVE-2026-5304 affects Axis devices via an ACAP configuration file input validation weakness. Exploitation requires the device to allow unsigned ACAP installations and user interaction to install a malicious ACAP app, potentially enabling privilege escalation (CVSS v3.1: 5.7, NETWORK, Privileges R...
CVE-2026-66774
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...
CVE-2026-58238
SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex t...
VulnCheck KEV: CVE-2022-50997
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2026-18950
creationtimestamp| type| source ---|---|--- 2026-08-10 23:01:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msr7em5vzi2a 2026-08-11 00:15:42+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3msrdjjue7q2v...