CVE-2026-37107

A vulnerability exists in HTMLy v.3.1.1 within the admin.php component. A remote attacker can exploit the get_feed function to perform a privilege escalation . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided in the documents.

PT-2026-111471

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158...

PT-2026-111169

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without...

CVE-2026-95121

An issue in mp4v2 2.0.0 allows an attacker to achieve arbitrary code execution . The vulnerability resides in the MP4RtpAtom::ReadHntiType() function within src/atom_rtp.cpp. A specially crafted MP4 file can trigger an unchecked offset subtraction in an undersized rtp atom, resulting in a near-2^...

PT-2026-113020

No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

PT-2026-113355

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction...

PT-2026-113364

ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

PT-2026-113362

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

EUVD-2026-98802

An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the assoutlineconstruct in libass/assrender.c...

PT-2026-111633

An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass outline construct in libass/ass render.c...

CVE-2026-106429

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint...

CVE-2026-95127

A vulnerability exists in libass v.0.17.5 that allows a remote attacker to trigger a denial of service (DoS) . The root cause is located within the ass_outline_construct() function in the libass/ass_render.c file. No specific remediation steps or exploitation details are provided in the documents.

CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

UBUNTU-CVE-2026-78358

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...

PT-2026-112023

Name of the Vulnerable Software and Affected Versions Windows Broadcast DVR User Service affected versions not specified Description A use after free condition in the Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Use after free is a memory...

PT-2026-111801

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 4.4.x through 4.4.9 FortiSandbox versions 5.0.x through 5.0.6 Description Improper access control and session management in the web management interface allow remote authentication bypass via HTTP. This issue enables...

PT-2026-111670

Name of the Vulnerable Software and Affected Versions Docker Hub affected versions not specified Description An authentication bypass flaw in the management of Personal Access Tokens PAT allowed attackers to impersonate users and organizations. An attacker could create a personal account, generat...

PT-2026-111426

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists in the Networking component caused by incorrect boundary...

PT-2026-112017

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.5 through 4.8.1 Description An untrusted search path issue exists that allows an authenticated local attacker to bypass Windows Defender Application Control WDAC restrictions. The attack involves using a...

UBUNTU-CVE-2026-106429

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint...