PT-2026-70300

Uncaught exception for some IntelR TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requiremen...

PT-2026-70492

Name of the Vulnerable Software and Affected Versions Windows Wired AutoConfig Service affected versions not specified Description A buffer over-read in the Windows Wired AutoConfig Service allows an authorized attacker to disclose sensitive information locally, which can affect the system...

PT-2026-70874

Name of the Vulnerable Software and Affected Versions PapersGPT for Zotero version 0.6.1 Description A remote code execution issue exists where arbitrary JavaScript can be executed by returning malicious code from an LLM endpoint. This occurs because the response is passed unsanitized to the...

PT-2026-70833

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

PT-2026-70277

Name of the Vulnerable Software and Affected Versions IntelR TDX module affected versions not specified Description Insecure storage of sensitive information within Ring 0: Trust Domain may allow information disclosure. A system software adversary with privileged user access could potentially...

CVE-2026-6727: Observable Timing Discrepancy

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

CVE-2026-48375: Incorrect Authorization

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...

CVE-2026-25194: Out-of-bounds Write

Out-of-bounds write in the firmware for the IntelR Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are...

CVE-2026-21269: Improper Neutralization of Input During Web Page Generation

ColdFusion is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

CVE-2026-20890: Improper Privilege Management

Improper privilege management for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege...

CVE-2026-20752: Improper Authentication

Improper authentication for some IntelR PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...

CVE-2025-31356: Insufficient Verification of Data Authenticity

Insufficient verification of data authenticity for some IntelR Trust Domain Extensions IntelR TDX within Ring 0: Hypervisor may allow an information disclosure. A system software adversary with a privileged user access combined with a high complexity attack may enable data exposure. This result m...

CVE-2025-0041: Uncontrolled Search Path Element

Uncontrolled search paths in the Vitis™ Embedded Single File Download SFD for local Windows installation could allow a low-privileged user to create arbitrary code execution...

CVE-2026-58235: Dependency on Vulnerable Third-Party Component

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

CVE-2026-44763: Improper Limitation of a Pathname to a Restricted Directory

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...

CVE-2026-48414: Improper Neutralization of Input During Web Page Generation

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-48413: Improper Neutralization of Input During Web Page Generation

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-6181: Authentication Bypass by Spoofing

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

PT-2026-70151

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description An authenticated Server-Side Request Forgery SSRF flaw exists in the OpenShift Console Dev Console webhook helpers. The system fetches user-supplied target URLs server-side without...