CVE-2026-56165

CVE-2026-56165: Heap-based buffer overflow in Microsoft Account enables remote code execution over a network. Affected: Microsoft Account service. Root cause: heap-based overflow (details not provided). Impact: high (confidentiality, integrity, availability). CVSS v3.1 base score 9.8 (CRITICAL); ...

CVE-2026-56165 Microsoft Account Remote Code Execution Vulnerability

...

CVE-2026-56165 Microsoft Account Remote Code Execution Vulnerability

...

labymod-poc

Security Audit Report — Laby Launcher 3.0.11 Target: Laby Launch...

CVE-2026-16805

Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-16806

Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2025-71389

Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...

CVE-2026-16805

CVE-2026-16805 is a use-after-free in Blink affecting Google Chrome prior to 150.0.7871.186, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome Stable Channel update mirrors this fix, upgrading to 150.0.7871.186 (Windows/Mac) or 150.0.7871....

CVE-2026-16805

Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-16805

Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-16806

Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-16806

CVE-2026-16806 affects Google Chrome WebMCP. A use-after-free in WebMCP can be triggered by visiting a crafted HTML page, allowing a remote attacker to execute arbitrary code inside the sandbox. The public sources confirm this vulnerability and tie it to the Chrome stable release update LP to 150...

CVE-2026-52439

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism...

CVE-2026-49035

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

CVE-2026-63732

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates fresh installs; a bypass of the LOCAL_ONLY network gate via a spoofed Host header; and unvalidated arguments passed to child_process.spawn() when registering MCP plugins....

CVE-2025-71389 Cal.com before 5.9.9 Remote Code Execution via RSC

Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...

CVE-2025-71389

Cal.com (calcom/cal.diy) versions before 5.9.9 are vulnerable to unauthenticated remote code execution via Next.js React Server Components (RSC) request handling that deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server to execute arbitrary code d...

CVE-2026-49035

CVE-2026-49035 affects libIEC61850’s MMS file service across version 1.0.0 through 1.6.1. The root cause is a heap-based buffer overflow triggered by an underflow of maxPduSize in the MMS Initiate processing (mms_file_service.c:834), allowing unauthenticated remote interaction. In experiments, re...

EUVD-2026-48430

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

CVE-2026-49035 Stack-based Buffer Overflow in MZ Automation libIEC61850

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...