CVE-2026-69289

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

CVE-2026-28616

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28616

The Setup Wizard contains a confused deputy vulnerability that allows an attacker to force a connection to a malicious network. This flaw can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. While the vulnerability is documented across...

CVE-2026-28616

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73965

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074

n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 is affected by a flaw in the Instance AI credential setup flow . The flow accepted a credential test or verification URL without verifying it matched the workflow node's origin, allowing attacker-controlled fetched content ...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

EUVD-2026-73438

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

CVE-2026-69289

CVE-2026-69289 is an elevation of privilege vulnerability in Windows Setup Files Cleanup , caused by improper link resolution before file access ("link following"). An authorized local attacker with low privileges can exploit it without user interaction to gain high impact across confidentiality,...

Windows Setup Files Cleanup Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

CVE-2026-69289: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

PT-2026-88215

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28616: Unintended Proxy or Intermediary

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-87336

Name of the Vulnerable Software and Affected Versions Windows Setup Files Cleanup affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At th...

Setup IPsec VPN — Updated!

English | 简体中文 | 繁體中文 | 日本語 | Русский IPsec VPN Server Auto Setup Scripts Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. An IPsec VPN encrypts your network traffic, so that nobody between you and the VPN server can eavesdrop on your data as it...

RUSTSEC-2026-0280 `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...