90833 matches found
CVE-2026-28626: URL Redirection to Untrusted Site
In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...
CVE-2026-77899: Use After Free
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally...
CVE-2026-71377: Improper Neutralization of Argument Delimiters in a Command
Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...
CVE-2026-49884: Buffer Copy without Checking Size of Input
In rwmfchandlereadop of rwmfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-81781: Missing Authorization
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-28596: Uncontrolled Resource Consumption
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28636: Unintended Proxy or Intermediary
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-84817: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
CVE-2026-71374: Deserialization of Untrusted Data
Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...
CVE-2026-86737: Missing Authorization
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-84386: Unverified Ownership
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via via an exposed minifilter communication port...
CVE-2026-77091: Improper Limitation of a Pathname to a Restricted Directory
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...
CVE-2026-84820: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...
CVE-2026-84818: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...
CVE-2026-81802: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
CVE-2026-81792: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5...
CVE-2026-77654: Incorrect Privilege Assignment
Improper Privilege Management vulnerability in Horizon Security Analyzer formerly AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that ...
CVE-2026-71376: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, fr...