CVE-2026-96244

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

CVE-2026-96244

A use after free vulnerability exists in Windows Internal System User Profile , which allows an authorized attacker to achieve local privilege elevation . The vulnerability is rated as HIGH severity (CVSS 3.1 score of 7.8). No specific exploit details or information regarding in-the-wild exploita...

CVE-2026-104005

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

Windows Internal System User Profile Elevation of Privilege Vulnerability

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96244: Windows Internal System User Profile Elevation of Privilege Vulnerability

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

CVE-2026-96244: Use After Free

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

CVE-2026-50425

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

CVE-2026-50425 Windows Internal System User Profile Elevation of Privilege Vulnerability

...

CVE-2026-50425

CVE-2026-50425: A use-after-free in Windows Internal System User Profile leads to local privilege escalation for an authorized attacker. Affected component: Windows Internal System User Profile; root cause: use-after-free; impact: gain high privileges locally with no user interaction (CVSSv3.1: A...

CVE-2026-50425 Windows Internal System User Profile Elevation of Privilege Vulnerability

...

CVE-2026-50425: Use After Free

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

PT-2026-58404

Name of the Vulnerable Software and Affected Versions Windows Internal System User Profile affected versions not specified Description A use after free issue in the Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. Use after free is a memory...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

HCL AION security vulnerabilities

HCL AION is an AI lifecycle management platform developed by the Indian company HCL. HCL AION has a security vulnerability, which stems from the possibility of exposing sensitive details related to backend infrastructure. This could lead to the disclosure of internal system architecture or...

PT-2026-40951

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Sensitive backend infrastructure details may be exposed, potentially revealing internal system architecture or configuration details. This exposure could assist in further analysis or target...

CVE-2026-33583: Exposed Dangerous Method or Function

Exposure of the QKEY used as input into the ‘OTA-Quantum’ device registration process and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03...

PT-2026-37164

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0 Description Missing authorization in the system API endpoint allows authenticated users to access sensitive information. Specifically, the '/api/system' endpoint leaks the installed...

EUVD-2026-17650

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints...

CVE-2026-34732

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo CreatePlugin template for list.json.php does not include any authentication or authorization check. While the companion templates add.json.php and delete.json.php both require admin privileges, the list.json.php...

CVE-2026-34732

CVE-2026-34732 concerns WWBN AVideo. Red Hat, OSV, CVE listings confirm that versions up to 26.0 contain a missing authentication/authorization check in the CreatePlugin template’s list.json.php, unlike add.json.php and delete.json.php which require admin rights. This omission creates 21 unauthen...