274189 matches found
CVE-2026-20901
Improper input validation for some IntelR XeonR processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack...
CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...
CVE-2026-48790
CVE-2026-48790 (turso-cli) : Versions prior to 1.0.26 store the Turso platform JWT in settings.json with world-readable permissions (0o644) due to Viper’s default configPermissions, enabling any local user on the host to read the file and exfiltrate the JWT, which grants full Turso platform acces...
CVE-2026-73083
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...
CVE-2026-70346
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-70355
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-70347
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-70348
Improper link resolution before file access 'link following' in Windows Management Services allows an authorized attacker to deny service locally...
CVE-2026-70340
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
CVE-2026-70344
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-70345
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-70335
Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...
CVE-2026-70335
Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...
CVE-2026-70338
Improper control of generation of code 'code injection' in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-70324
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-70326
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-70330
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally...
CVE-2026-70307
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...