USN-8149-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - Netfilter; - Network traffic control; CVE-2026-23060, CVE-2026-23074, CVE-2026-23111...

PT-2026-32731

Name of the Vulnerable Software and Affected Versions Microsoft Windows 10 versions 10.0.14393.0 through 10.0.14393.9059 Description Insufficient UI warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network by misleading users int...

Microsoft Windows GDI 缓冲区错误漏洞

Microsoft Windows GDI is a core underlying standard interface in the Windows operating system developed by Microsoft, responsible for drawing graphical objects on the screen or printer, managing fonts, and processing images. There is a buffer error vulnerability present in Microsoft Windows GDI...

The vulnerability of the command-line interface (CLI) of Cisco IOS XR operating systems allows a attacker to elevate their privileges to the root level and execute arbitrary code.

The vulnerability of the command-line interface CLI of Cisco IOS XR operating systems is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level and execute arbitrary code...

PT-2026-32973

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.2 and earlier Description An improper path validation issue exists in the UDR service. An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by...

PT-2026-32652

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions,...

📄 WebRemoteControl Unauthenticated Remote Filesystem Access

WebRemoteControl suffers from an unauthenticated remote filesystem access vulnerability. This proof of concept exploit lets you browse directory contents and access files. Exploit Title: WebRemoteControl - Unauthenticated Remote Filesystem Access Date: 2026-04-14 Exploit Author: Chokri Hammedi...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There is a resource management vulnerability in the Microsoft Windows User Interface Core. Attackers can exploit this vulnerability to gain higher privileges. The following products and versions a...

Microsoft Windows 竞争条件问题漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There are vulnerabilities related to the Microsoft Windows User Interface Core. Attackers can exploit these vulnerabilities to gain higher privileges. The following products and versions are...

PT-2026-32832

CVE-2026-32163 Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate pr… https://t.co/NRHk53N5jl...

PT-2026-32816

Name of the Vulnerable Software and Affected Versions Windows Speech Brokered Api affected versions not specified Description A race condition occurs due to concurrent execution using a shared resource with improper synchronization. This allows an authorized attacker to elevate privileges locally...

Microsoft Windows GDI 缓冲区错误漏洞

Microsoft Windows GDI is a core underlying standard interface within the Windows operating system developed by Microsoft, responsible for drawing graphical objects on the screen or printer, managing fonts, and processing images. There is a buffer error vulnerability present in Microsoft Windows...

PT-2026-32833

CVE-2026-32164 Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate pr… https://t.co/ysmZfg3MT0...

Schneider Electric PowerChute Serial Shutdown 路径遍历漏洞

Schneider Electric PowerChute Serial Shutdown is a UPS management, normal shutdown and energy management software from Schneider Electric, France. A path traversal vulnerability exists in Schneider Electric PowerChute Serial Shutdown, which can be exploited by an attacker to cause a web...

The vulnerability in the web interface of the Cisco Finesse software for controlling operator operations, as well as the web platform for generating reports in the Cisco Unified Intelligence Center, allows a perpetrator to execute arbitrary code.

The vulnerability in the web interface of the Cisco Finesse software for operator management and the Cisco Unified Intelligence Center reporting web platform is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute...

PT-2026-32576

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting XSS vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface /ui/chat/access token, the...

KLA90986 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, gain privileges, cause denial of service, spoof user interface, execute arbitrary code, read local files. Below is a complete...

PT-2026-32974

Name of the Vulnerable Software and Affected Versions free5GC versions 4.2.1 and earlier Description An improper path validation issue exists in the UDR service. The endpoint 'GET /nudr-dr/v2/application-data/influenceData/influenceId/subscriptionId' is designed to operate only when the influence...

PT-2026-32773

CVE-2026-27911 Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate pr… https://t.co/1EBHUgkLHF...

PT-2026-32975

Name of the Vulnerable Software and Affected Versions free5GC UDR service versions prior to 4.2.1 Description An improper path validation issue exists in the UDR service. The handler for creating or updating Traffic Influence Subscriptions checks if the influenceId path segment equals...