CVE-2026-53413 Zoom Clients - Buffer Over-write

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

EUVD-2026-56239

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53413 Zoom Clients - Buffer Over-write

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

CVE-2026-53413

CVE-2026-53413 involves missing bounds checks in the annotator function of Zoom Clients, leading to a buffer overwrite vulnerability. The underlying issue is a lack of input validation in the annotator component, which can potentially allow a meeting participant to perform remote code execution o...

GHSA-H784-HPJP-2RRM Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution...

Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-957r-qf9p-67xw. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The creat...

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Windows License Manager Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-72548

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without...

CVE-2026-72549

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

CVE-2026-72543

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks...

CVE-2026-72545

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target...

CVE-2026-68223

A flaw was found in the Linux kernel's media: meson: vdec driver. The vdecopen function, when encountering an error during initialization, fails to properly release a memory context. This oversight leads to a resource leak. A local attacker could exploit this vulnerability to cause a denial of...

EUVD-2026-56043

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72549 OpenSignLabs OpenSign - Information Disclosure

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

EUVD-2026-56019

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

CVE-2026-72549 OpenSignLabs OpenSign - Information Disclosure

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

CVE-2026-72549

OpenSignLabs OpenSign (through version 2.37.0) contains an information disclosure vulnerability in the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal user objectId, enabling unauthenticated remote attackers to map any email addr...

CVE-2026-72549

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...