Microsoft Excel Information Disclosure Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

Azure IoT Explorer Information Disclosure Vulnerability

Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network...

gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing

A flaw was found in GIMP. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the conte...

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-core (CVE-2025-41249)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2025-41249 of spring-core-6.2.6.jar. Vulnerability Details CVEID:CVE-2025-41249 DESCRIPTION: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a...

CVE-2025-70033

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...

CVE-2026-3794

A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and...

CVE-2025-70039

An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223...

RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

Impact Vulnerability Type: Improper Control of Generation of Code 'Code Injection' CWE-94 / Improper Check for Unusual or Exceptional Conditions CWE-754 / Improper Input Validation CWE-20 / Use of Low-Level Functionality CWE-695 / Improper Privilege Management CWE-269 / External Control of System...

PT-2026-24336

Name of the Vulnerable Software and Affected Versions Azure Arc affected versions not specified Description An improper authentication issue exists in Azure Arc that could allow an authorized attacker to elevate privileges locally. Microsoft has disclosed three elevation of privilege flaws in Azu...

Intel Processors 缓冲区错误漏洞

Intel Processors are a series of processors developed by the American company Intel. Intel Processors have a buffer overflow vulnerability, which stems from improper buffer limits and may lead to privilege escalation. System software attackers with privileged access can potentially manipulate dat...

Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

Webauthn Framework 访问控制错误漏洞

Webauthn Framework is an open-source authentication mechanism for Web-Authentication. It enables web applications to create and use powerful, proven, scoped, public-key-based credentials for strong user authentication. Versions of Webauthn Framework prior to 5.2.4 contained an access control...

Digital Arts i-フィルター 安全漏洞

Digital Arts i-Filter is a harmful website filtering browser developed by the Japanese company Digital Arts. Digital Arts i-Filter has a security vulnerability, which stems from improper file access permission settings. This vulnerability may allow non-administrator users to create or overwrite...

Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cdd.dll driver...

PT-2026-24316

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no informati...

PT-2026-24363

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.14.24 through 3.19.3 Description An improper authorization issue was found in GitHub Enterprise Server. A user with read access to a repository and write access to a project could modify issue and pull reque...

The vulnerabilities of the functions hisi_acc_vfiopci_open_device() and hisi_acc_vfiopci_close_device() in the drivers/vfio/pci/hisilicon/hisi_acc_vfiopci.c driver for VFIO device controllers in the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions hisiaccvfiopciopendevice and hisiaccvfiopciclosedevice in the drivers/vfio/pci/hisilicon/hisiaccvfiopci.c driver for VFIO devices in the Linux operating system is related to improper initialization. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the i40e_vc_config_queues_msg() function in the drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c file of the Intel Ethernet network adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the i40evcconfigqueuesmsg function in the drivers/net/ethernet/intel/i40e/i40evirtchnlpf.c module of the Intel Ethernet network adapter driver for the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an...

Zoom Workplace VDI Client 6.6 < 6.6.11 Vulnerability (ZSB-26002)

The version of Zoom Workplace VDI Client installed on the remote host is between 6.6 and 6.6.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26002 advisory. - Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an...

Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cdd.dll driver...