Important: dotnet10.0

Issue Overview: Improper authorization in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-45490 Improper link resolution before file access 'link following' in .NET allows an unauthorized attacker to perform tampering locally. CVE-2026-45491 Uncontrolled resource...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-1868)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1868 advisory. Improper authorization in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-45490 Improper link resolution before file access 'link following' in .NET allows an...

CVE-2025-66389

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder without user approval via a file-handler URI parameter to fetchwebpage. Therefore, exfiltration could occur if there is indirect prompt injection...

CVE-2026-44274: Improper Link Resolution Before File Access

Dell Wyse Management Suite WMS, versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-51371

Name of the Vulnerable Software and Affected Versions TP-Link routers affected versions not specified Description Insufficient validation of externally supplied DHCP option data in the DHCP option processing logic allows an adjacent, unauthenticated attacker to execute arbitrary commands with...

Windows Microsoft PC Manager Incorrect Link File

The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations is related to an incorrect definition of the link before accessing a file. Exploiting this vulnerability can allow attackers to increase their privileges...

GHSA-MH64-PH39-MRC9

creationtimestamp| type| source ---|---|--- 2026-06-21 20:11:16+00:00| seen| https://gist.github.com/alon710/c5b3f5c6eff1ab2b8225ee8d2a46e1e8...

CVE-2026-56404

creationtimestamp| type| source ---|---|--- 2026-06-21 18:26:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mosypq3crw22 2026-06-26 00:01:44+00:00| seen| https://bsky.app/profile/slackers.it/post/3mp5ncaeykp26...

CVE-2026-56410

creationtimestamp| type| source ---|---|--- 2026-06-21 17:52:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moswsrivk52n 2026-06-26 00:01:47+00:00| seen| https://bsky.app/profile/slackers.it/post/3mp5ncbgb2u2x...

GHSA-XJ2C-G5XP-4P47 Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x76w-8c62-48mg. This link is maintained to preserve external references. Original Description Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user...

Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x76w-8c62-48mg. This link is maintained to preserve external references. Original Description Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user...

CVE-2026-56384

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...

CVE-2026-49287

creationtimestamp| type| source ---|---|--- 2026-06-21 14:02:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mosjwafv3w2c...

CVE-2026-12796

creationtimestamp| type| source ---|---|--- 2026-06-21 14:00:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mosjszfxgj2c...

CVE-2026-56384

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...

CVE-2026-12778

creationtimestamp| type| source ---|---|--- 2026-06-21 08:12:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3morwedwvx32x 2026-06-22 12:39:57+00:00| seen| https://www.acn.gov.it/portale/w/aomei-disponibili-poc-pubblici-per-le-cve-2026-12778-cve-2026-12779-e-cve-2026-12780...

CVE-2026-12770

creationtimestamp| type| source ---|---|--- 2026-06-21 03:59:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3morib5g34w2r...

PT-2026-51268

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 1.0.12 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 2.0.12...

CVE-2026-56347

creationtimestamp| type| source ---|---|--- 2026-06-20 20:57:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqqmlymxy2i...

CVE-2026-56347

AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site...