46182 matches found
CVE-2026-86564 Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler
A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...
CVE-2026-86564
A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...
MAL-2026-16052 Malicious code in open-item-validator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...
CVE-2026-78574 Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...
CVE-2026-84869 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...
CVE-2026-84869 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...
CVE-2026-84869
CVE-2026-84869 affects the ScreenConnect client (by ConnectWise). A condition in the client allows a guest to transfer and execute files on the host through an active remote session without proper authorization or Host confirmation, as described in the CVELIST record title. ScreenConnect servers ...
CVE-2026-69682
Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69351
Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...
CVE-2026-68830
Improper link resolution before file access 'link following' in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...
Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities
Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-10841 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling. CWE:CWE-444: Inconsistent...
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...
CVE-2026-84393
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via...
CVE-2026-82533
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...
CVE-2026-69682
CVE-2026-69682 is a use-after-free vulnerability in the Windows Host Guardian Service component that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high attack complexity and required lo...
EUVD-2026-73572
Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69351
Windows Universal Plug and Play (UPnP) Device Host contains an information disclosure vulnerability that allows a locally authenticated attacker with low privileges to expose private personal information without user interaction. The CVSS v3.1 score is 5.5 (Medium) with a high confidentiality imp...
EUVD-2026-73456
Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...
CVE-2026-68830
CVE-2026-68830 is an information disclosure vulnerability in Windows Universal Plug and Play (UPnP) Device Host , caused by improper link resolution before file access ('link following'). An authorized local attacker (low privileges, no user interaction) can exploit this to disclose information, ...