PT-2026-87137

In affected Snowflake drivers, WORKLOAD IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-84393: Improper Validation of Certificate with Host Mismatch

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via...

CVE-2026-82533: Reliance on Untrusted Inputs in a Security Decision

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-69682: Use After Free

Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69351: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

CVE-2026-68830: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

CVE-2026-19397: Missing Authentication for Critical Function

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

PT-2026-88316

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions prior to 26.6.5 Description A flaw in the ScreenConnect client allows files to be transferred and executed through an active remote session without authorization or host confirmation under certain...

PT-2026-86974

Name of the Vulnerable Software and Affected Versions ASUS Control Center Express Agent affected versions not specified Description Missing authentication for a critical function allows an unauthenticated nearby user to achieve remote code execution and control the host via a direct connection to...

PT-2026-87392

Name of the Vulnerable Software and Affected Versions Windows Universal Plug and Play UPnP Device Host affected versions not specified Description An issue in the Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to locally disclose private personal information to an...

PT-2026-87183

New security alarm: Fortinet’s Agentless ZTNA has a certificate‐validation flaw CVE-2026-84393 letting attackers perform MITM on FortiOS and FortiProxy. Versions 7.6.1-7.6.6 are vulnerable; upgrade to 7.6.7 or later. This unauthenticated risk puts exposed portals at serious risk—patch now if you...

PT-2026-87268

Name of the Vulnerable Software and Affected Versions Windows Universal Plug and Play UPnP Device Host affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to disclose information locally. This issue...

PT-2026-87653

Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...

PT-2026-87187

Name of the Vulnerable Software and Affected Versions DeepSeek Harness versions prior to 0.1.2-alpha.1 Description An authentication bypass exists in the local HTTP agent-control API. The system grants unauthenticated access by accepting a client-supplied loopback Host header instead of validatin...

CVE-2026-86564: Out-of-bounds Read

A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...

EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-3256)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : 'This is a PUBLIC release of a low-severity vulnerability in runc which\nhas been fixed in runc 1.3.6, runc 1.4.3, and runc 1.5.0-rc.3. There...

CVE-2026-86590: Server-Side Request Forgery (SSRF)

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...

EulerOS 2.0 SP12 : spice-vdagent (EulerOS-SA-2026-3312)

According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...

VulnCheck KEV: CVE-2026-84869

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation...

PT-2026-87064

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...