CVE-2026-21726: Improper Limitation of a Pathname to a Restricted Directory

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/namespace Thanks to Prasanth Sundararajan for reporting this vulnerability...

CVE-2025-40897: Incorrect Authorization

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform...

CVE-2025-52641: Generation of Error Message Containing Sensitive Information

HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information...

CVE-2024-53412: Improper Neutralization of Special Elements used in a Command

Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field...

CVE-2026-40778: Missing Authorization

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through = 1.1.2...

Vulnerable-Web-App-Scanner

Vulnerable-Web-App-Scanner Pent...

CVE-2026-2401: Insertion of Sensitive Information into Log File

CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker...

CVE-2026-2399: Improper Limitation of a Pathname to a Restricted Directory

CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause critical files overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload...

CVE-2026-32220: Improper Access Control

Improper access control in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

CVE-2026-32196: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-2403: Improper Validation of Specified Quantity in Input

CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...

CVE-2026-26155: Buffer Over-read

Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability...

CVE-2026-2400: Improper Neutralization of CRLF Sequences

CWE-93 Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability exists that could cause application user credentials to reset when a Web Admin user alters the POST /setPCBEDesc request payload...

CVE-2026-26169: Buffer Over-read

Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally...

CVE-2026-27909: Use After Free

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-33825: Insufficient Granularity of Access Control

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally...

CVE-2026-32168: Improper Input Validation

Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-32192: Deserialization of Untrusted Data

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-37591: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/viewdetails.php...

CVE-2026-27304: Improper Input Validation

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction...