PT-2026-36828

An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdownMachine and putMachineToSleep functions in PostCompressionActions.cpp...

CVE-2018-25283

CVE-2018-25283 affects iSmartViewPro 1.5. The vulnerability is a SEH-based buffer overflow in the 'Save Path for Snapshot and Record file' field. A crafted payload exceeding 260 bytes via the System Setup interface can overwrite SEH records and execute shellcode with application privileges, enabl...

EUVD-2026-25715

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made...

CVE-2026-7038

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made...

CVE-2026-7038

The CVE-2026-7038 affects tufantunc ssh-mcp prior to 1.5.0, specifically an unknown function in src/index.ts of the Command Line Handler. The root cause is a weakness that leaves credentials insufficiently protected, enabling local exploitation. The attack is restricted to local execution, and an...

PT-2026-35221

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made...

CVE-2026-41179

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs...

PT-2026-43126

Name of the Vulnerable Software and Affected Versions GNU LibreDWG versions prior to 0.15 Description The decompress R2004 section function within the src/decode.c file of the Dwgread Utility contains an uncontrolled reachable assertion. This issue allows a local attacker to cause a denial of...

CVE-2026-5789 Search path without quotes in CivetWeb

Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path C:\Program...

OpenClaw: Heartbeat owner downgrade missed local async exec completion events

Summary Heartbeat owner downgrade missed local async exec completion events. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.3.31 = 2026.4.10 Impact Local background exec completion text could be missed by heartbeat owner-downgrade detection, leaving ...

Shopify: mruby-engine: UAF in MRubyEngine#initialize enables local RCE

Summary Double-init of MRubyEngine frees engine + unmaps mspace, but leaves Ruby DATAPTR dangling. Kernel reuses freed VA via mmapMAPFIXED. Attacker forges memrubyengine struct + mrbstate in reclaimed region, points mrbstate-allocf at libc.system, arranges bytes of mrbstate to also spell a shell...

PT-2026-33382

Name of the Vulnerable Software and Affected Versions home-assistant-cli versions prior to 1.0.0 Description The Home Assistant Command-line interface hass-cli used an unrestricted environment instead of a sandboxed one to handle Jinja2 templates. User-supplied input within these templates was...

CVE-2026-32190

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

EUVD-2026-22633

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

EUVD-2026-22569

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-22571

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

EUVD-2026-22534

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-33095

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-32723

CVE-2026-23657 | Microsoft 365 Apps for Enterprise | Remote Code Execution Description A use-after-free vulnerability in Microsoft Office Word in Microsoft 365 Apps for Enterprise allows an unauth attacker to achieve local RCE by tricking a user into opening a malicious document that triggers...