Microsoft Digest Authentication Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally...

Win32k Information Disclosure Vulnerability

Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2025-5777

CVE-2025-5777 — Citrix NetScaler "CitrixBleed 2" Memory Disclosure Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. The sequel to the original CitrixBleed: an out-of-bounds read on NetScaler ADC/Gateway authentication endpoints that...

CVE-2026-8451

🚨 CVE-2026-8451 - NetScaler SAML IdP Memory Overread Vulnerability A pre-authentication memory disclosure vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway configured as a SAML Identity Provider IdP. ✨ Overview CVE-2026-8451 is a High-Severity memory disclosure vulnerability caus...

CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...

CVE-2026-93347

Wazuh versions 4.1.1 before 4.14.8 are vulnerable to a path traversal vulnerability in the get_list_file helper. This flaw occurs because the system fails to validate filename values, allowing malicious cluster workers to read arbitrary files. An attacker possessing the cluster key can send Distr...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

CVE-2026-74034

Wazuh versions 4.1.0 before 4.14.8 are vulnerable to an arbitrary file read vulnerability due to a missing origin check in the wm_agent_upgrade component. This flaw allows enrolled agents to issue upgrade_custom commands using an attacker-controlled file_path . An attacker can inject an upgrade_c...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachme...

CVE-2026-109957

Versions of EspoCRM prior to 10.0.7 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. This vulnerability exists in the Import endpoint , where authenticated users with Import scope access can read attachments belonging to other users by providing a foreign attachmentId . An attac...

CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-109951

The FreeRDP application (versions 3.17.1 before 3.32.0 ) is vulnerable to a heap buffer over-read in the DynvcTrackerHandleCreateBack function of the freerdp-proxy DRDYNVC channel handler. The root cause is an unbounded snprintf read triggered when a malicious backend RDP server sends a CREATE_RE...

CVE-2026-109950 FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages...

CVE-2026-109950

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages...

CVE-2026-109950

FreeRDP versions 3.0.0 through 3.31.x are vulnerable to a heap out-of-bounds read vulnerability when processing RD Gateway messages. The root cause is a mismatch in message lengths where an attacker controlling the gateway can set MsgBytes significantly larger than the NDR string ActualCount with...

CVE-2026-109677 FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...