CVE-2026-70337: Relative Path Traversal

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network...

CVE-2026-62909: Unchecked Return Value

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

CVE-2025-0046: Incorrect Permission Assignment for Critical Resource

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution...

CVE-2026-42976: Missing Authentication for Critical Function

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally...

CVE-2026-18972: Authentication Bypass by Spoofing

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

CVE-2026-33922: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

CVE-2026-73232: Improper Handling of Highly Compressed Data (Data Amplification)

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-62915: Missing Authorization

Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network...

RHEL 7 : host-metering (RHSA-2026:53416)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53416 advisory. Host metering service Security Fixes: crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries...

CVE-2026-62886: Integer Overflow or Wraparound

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally...

CVE-2026-48439: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-62781: Heap-based Buffer Overflow

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

CVE-2026-61927: Use After Free

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-71384: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The...

CVE-2026-19519: Reachable Assertion

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service...

CVE-2026-61936: Missing Authorization

Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally...

CVE-2026-66809: Out-of-bounds Read

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally...

Linux Distros Unpatched Vulnerability : CVE-2026-68346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from t...

deepslop

DEEPSLOP — PS5 WebKit Exploit Kit 13.60 / WebKit RCE كيت اس...

CVE-2026-6791: Stack-based Buffer Overflow

When expanding paths that begin with a tilde followed by a username, the internal parsetilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this...