54149 matches found
CVE-2026-20146: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the...
Active Directory Domain Services Code Execution
The vulnerability of Active Directory Domain Services AD DS on Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-60190
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an...
Active Directory Federation Services Privilege Escalation
The vulnerability of the Active Directory Federation Services AD FS for Windows operating systems is related to deficiencies in access control mechanisms. Exploiting this vulnerability can allow attackers to increase their privileges...
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft's own CVEs by its Security Update Guide count, more than triple June's previous high of around 200. Those two live bugs are the...
CVE-2026-61520 Simple Machines Forum SSRF via image proxy
Simple Machines Forum 2.1 prior to commit b4d23df fixed in 2.1.8 and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags...
EUVD-2026-44490
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...
CVE-2026-61520 Simple Machines Forum SSRF via image proxy
Simple Machines Forum 2.1 prior to commit b4d23df fixed in 2.1.8 and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags...
CVE-2026-61520
The CVE-2026-61520 entry documents a server-side request forgery in Simple Machines Forum (SMF) image proxy. Affected versions are SMF 2.1 prior to commit 4bf35cf and SMF 3.0 prior to commit b4d23df. The vulnerability allows authenticated attackers to trigger internal HTTP requests by embedding a...
CVE-2026-61520 Simple Machines Forum SSRF via image proxy
Simple Machines Forum 2.1 prior to commit b4d23df fixed in 2.1.8 and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Axios
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Axios. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and...
EUVD-2026-44139
Improper authorization in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges over a network...
EUVD-2026-44134
Improper neutralization of input during web page generation 'cross-site scripting' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...
EUVD-2026-44138
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
EUVD-2026-44073
Stack-based buffer overflow in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
EUVD-2026-43866
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network...
EUVD-2026-43941
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43903
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...