CVE-2026-19270

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...

CVE-2026-18785

A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UAClientgetRemoteDataTypes of the file examples/customdatatype/clienttypescustom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the loc...

CVE-2026-18784 o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflow

A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UAClientreadNodeClassAttribute of the file src/client/uaclienthighlevel.c. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit has been made public a...

CVE-2026-41447

FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files x86\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration...

CVE-2026-64266

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. The fusereffolio function does not properly re-lock a request after unlocking it, which can lead to a use-after-free vulnerability. A local attacker could exploit this flaw to potentially execute arbitrary code or caus...

B&R Automation X20EDS410 Incorrect Resource Transfer Between Spheres (CVE-2026-31431)

The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's crypto algifaead in-place operation handling. Successful local exploitation of this vulnerability could allow an authenticated attacker with low privileges to escalate...

CVE-2026-64367

A flaw was found in the Linux kernel's hid-goodix-spi driver. This vulnerability, a stack buffer overflow, allows a local attacker to provide an oversized report to the system. This can lead to a buffer overflow, potentially enabling the attacker to execute arbitrary code with elevated privileges...

EUVD-2026-49048

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16630 syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function childprocess.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly a...

CVE-2026-64099

A flaw was found in the Linux kernel's drm/v3d graphics driver. This vulnerability, a use-after-free error, occurs in the CPU job input/output control ioctl error path. When an error is encountered, the system attempts to access memory that has already been freed, which can lead to system...

PT-2026-61670

Name of the Vulnerable Software and Affected Versions ExtremeXOS EXOS affected versions not specified Description The mv, cp, and rm file utilities within the shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. This allows an...

CVE-2026-16129

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

EUVD-2026-45358

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...

CVE-2026-16082 Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...

CVE-2026-15749 mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal

A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcpC2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local...

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-15621 mosaxiv clawlet File Tools fs_ops.go edit_file link following

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function readfile/writefile/editfile of the file tools/fsops.go of the component File Tools. Performing a manipulation results in link following. The attack needs to be approached locally. The reported GitHub issue was...

PT-2026-58545

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow exists in Microsoft Office Excel, which could allow an unauthorized attacker to execute arbitrary code locally on the system. This occurs when a us...

PT-2026-58184

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A use-after-free issue in the Graphics Kernel allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption flaw that occur...