PT-2026-70776

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A heap-based buffer overflow occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory corruption issu...

PT-2026-70407

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description An integer overflow or wraparound occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally on the system. Recommendations At the moment, there ...

PT-2026-70444

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally, which enables them to affect the system. Recommendations At the moment, the...

KLA91202 PE vulnerability in Microsoft Apps

Privilege escalation vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-68821 Exploitation Related products App-Installer CVE list CVE-2026-68821 critical KB list Solution Install necessary updates from the KB...

CVE-2026-70344: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

EUVD-2026-55652

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

CVE-2026-18412 The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

CVE-2026-18412

The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability during the installation of .ocmod.zip files. The installer extracts these files but fails to validate that the extracted paths remain within the intended directory. An attacker can craft a malicious extension u...

Installer for LINE for Windows insecurely loads Dynamic Link Libraries

Overview The installer for LINE for Windows provided by LY Corporation contains the following vulnerability: Uncontrolled search path element CWE-427 - CVE-2026-13133 The CVSS evaluation above assumes that a victim user is directed to download and place a specially crafted DLL file alongside the...

CVE-2026-13133

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

CVE-2026-13133

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

CVE-2026-13133

LineInst.exe (LINE for Windows) before version 26.4.0 is vulnerable because Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer directory to be loaded ahead of the legitimate System32 copy. The CVSS metrics indicate a HIGH ...

CVE-2026-13133

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

CVE-2026-13133

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

EUVD-2026-55033

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

PT-2026-69852

Name of the Vulnerable Software and Affected Versions OpenCart version 4.2.0.0 Description The extension installer fails to validate that extracted paths from uploaded .ocmod.zip files remain within the intended directory. This allows an attacker to use directory traversal sequences, such as ../,...

CVE-2026-18412: Undefined Security Weakness

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

OpenCart ecommerce platform contains directory traversal vulnerability

Overview The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. Th...

EUVD-2026-54859

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...