PT-2026-104815

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

PT-2026-106025

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

PT-2026-104709

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78861

The Mercusys AC12 V2 is vulnerable to a flaw where a local attacker can execute arbitrary code . This vulnerability is caused by the inclusion of a hardcoded 512-bit RSA Private Key within the device. While the CVSS 3.1 score is 7.7 (High) , indicating high impact on confidentiality and integrity...

PT-2026-106221

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

PT-2026-106205

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.0 Description An input validation issue in this Node.js content management system may allow staff users to access local files located outside the intended data storage directories on the server. Recommendatio...

PT-2026-106149

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth affected versions not specified Description An uninitialized pointer dereference in the handle le monitor device event function within msft.cc allows for a control-flow hijack in the privileged bluetooth process. This issue...

PT-2026-104703

In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761...

PT-2026-106154

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A permission bypass exists in the dialInternal function across multiple locations due to a confused deputy issue. A confused deputy is a security vulnerability...

PT-2026-106153

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A memory safety issue exists in the FilterCapturedPacket function within snoop logger.cc due to improper input validation. This flaw allows for local escalation ...

PT-2026-106160

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in multiple functions of VirtualAudioControllerTest.java allows for a permission bypass. This issue can lead to local escalation of privilege witho...

PT-2026-106158

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104683

Name of the Vulnerable Software and Affected Versions neuropilot affected versions not specified Description A missing bounds check in neuropilot allows for an out-of-bounds write, which is a condition where data is written outside the intended memory boundary. This flaw could enable local...

CVE-2026-28641: Undefined Security Weakness

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-20589: Out-of-bounds Write

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606...

CVE-2026-20522: Out-of-bounds Write

In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249050; Issue ID: MSV-9172...

CVE-2026-49937: Improper Restriction of Operations within the Bounds of a Memory Buffer

In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28667: Improper Restriction of Operations within the Bounds of a Memory Buffer

In multiple functions of rwt5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20587: Access of Resource Using Incompatible Type

In mtee, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9608...