CVE-2026-83735

Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-83908

A Release of Invalid Pointer or Reference vulnerability exists in the RPC Runtime . This flaw allows an authorized attacker to perform a local privilege escalation . The vulnerability is associated with CWE-763 and has a CVSS 3.1 base score of 7.0 (High) . No specific software versions, root caus...

CVE-2026-83735

A Release of invalid pointer or reference vulnerability in the Windows Kernel allows an authorized attacker to perform a local privilege escalation . This issue is associated with CWE-763 . While the vulnerability has a high severity score, specific details regarding the affected component, preci...

CVE-2026-110213 ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2026-110126

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/address...

CVE-2026-110124

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110120

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET...

CVE-2026-110121

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110119

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/id, /address/del and...

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-93193

A flaw was found in the Linux kernel's drm/rockchip: analogixdp component. A reference leak occurs in the rockchipdpdrmencoderenable function because ofgetchildbyname does not symmetrically call ofnodeput. This can lead to resource exhaustion, potentially causing a denial of service DoS for the...

CVE-2026-110113

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110098

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

SUSE CVE-2026-102700

With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 CVE-2017-14318 then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is...

DEBIAN-CVE-2026-102700

With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 CVE-2017-14318 then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is...

ALPINE-CVE-2026-102700

With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 CVE-2017-14318 then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is...

CVE-2026-102700

With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 CVE-2017-14318 then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is...

CVE-2026-102700

With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 CVE-2017-14318 then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is...