74681 matches found
EUVD-2026-43942
Improper link resolution before file access 'link following' in Windows Projected File System allows an authorized attacker to elevate privileges locally...
EUVD-2026-44069
Improper link resolution before file access 'link following' in Microsoft PC Manager allows an authorized attacker to elevate privileges locally...
EUVD-2026-43777
Improper link resolution before file access 'link following' in Window PC Manager allows an authorized attacker to elevate privileges locally...
EUVD-2026-43847
Improper link resolution before file access 'link following' in Windows Server Backup allows an authorized attacker to elevate privileges locally...
EUVD-2026-43806
Improper link resolution before file access 'link following' in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...
EUVD-2026-43797
Improper link resolution before file access 'link following' in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...
CVE-2026-45753
Symfony HtmlSanitizer UrlAttributeSanitizer omits action, formaction, poster, and cite URL-valued attributes, allowing javascript: URIs to bypass sanitization and enable XSS when forms or buttons are used. Affected: Symfony components prior to versions 6.4.40, 7.4.12, and 8.0.12. Mitigation: upgr...
CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...
CVE-2026-50469
Improper link resolution before file access 'link following' in Windows Projected File System allows an authorized attacker to elevate privileges locally...
CVE-2026-50438
Improper link resolution before file access 'link following' in Microsoft PC Manager allows an authorized attacker to elevate privileges locally...
CVE-2026-45066
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-5040
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...
CVE-2026-45066
CVE-2026-45066 affects Symfony’s HtmlSanitizer: URL sanitization bypass due to UrlSanitizer::parse() following RFC 3986 while browsers use WHATWG, and because is checked against the media policy instead of the link policy. Affected versions: 6.1.0-BETA1–6.4.40, 7.4.12, and 8.0.12. Impact: off-al...
CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-45066
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-51821
creationtimestamp| type| source ---|---|--- 2026-07-14 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmqbeydro2w...
Malicious Package
Overview node-fsmetrics-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-58636
Improper link resolution before file access 'link following' in Window PC Manager allows an authorized attacker to elevate privileges locally...