373992 matches found
CVE-2026-70085
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-70087
Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally...
CVE-2026-70083
Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-70071
Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-70069
Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network...
CVE-2026-70066
Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally...
CVE-2026-70058
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network...
CVE-2026-69795
Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally...
CVE-2026-69830
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DHCP Server allows an unauthorized attacker to execute code over a network...
DEBIAN-CVE-2026-110249
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...
CVE-2026-110249
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...
CVE-2026-110254
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses...
DEBIAN-CVE-2026-110225
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...
CVE-2026-110222
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...
CVE-2026-108127
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
CVE-2026-108128
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
CVE-2026-108129
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
CVE-2026-105009
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally...