CVE-2026-36981

CVE-2026-36981 is evidenced by a PoC exploit targeting the pwdrvio.sys driver in MiniTool Partition Wizard, enabling memory corruption and an arbitrary kernel write to achieve SYSTEM privileges. This confirms a kernel-level privilege-escalation vulnerability. Remediation details are not provided ...

CVE-2026-36980

CVE-2026-36980 affects MiniTool Partition Wizard driver pwdrvio.sys (PartitionWizardDiskAccesser\0). The connected exploit details show an IOCTL vulnerability (0x22000d) in pwdrvio.sys IOCTL handler that enables a local unprivileged user to trigger a buffer overflow: an input buffer of 1024 bytes...

CVE-2026-13431

Technical details for CVE-2026-13431 are not publicly available in the provided documents. No affected products, root cause, or remediation are specified. Monitor sources for updates.

CVE-2025-68624

Technical details for CVE-2025-68624 are not publicly available in the provided documents. No affected products, versions, root cause, or remediation are disclosed here. Monitor CIRCL sighting and official advisories for updates.

CVE-2026-42940

Technical details for CVE-2026-42940 are not publicly available in the provided documents; no affected products, impact, or fixes are disclosed. Monitor for updates.

CVE-2026-31341

CVE-2026-31341 is currently described as reserved with no public technical details in the Initial document. The Connected documents show an exploit repository titled “cve-2026-31341-copy-fail-checker” (GitHub) and a CIRCL sighting indicating a Telegram source, but there are no concrete details ab...

CVE-2026-7275

Technical details for CVE-2026-7275 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-4047

Technical details for CVE-2026-4047 are not publicly available in the provided documents; no affected products, impact, or remediation are described. Monitor for updates.

CVE-2026-21847

CVE-2026-21847 is a real issue in DPDC’s Subscription Portal (subscription.dpdatacenter.com) where a hardcoded AES-256 key is embedded in client-side JavaScript (app.1773634386574.js) and used with CryptoJS AES.decrypt/encrypt to protect tokens stored in localStorage. The key is exposed in the so...

CVE-2026-26903

CVE-2026-26903 affects TanStack Query (React Query) and related core packages. The vulnerability lies in TanStack Query’s replaceEqualDeep function, which recursively traverses nested objects without a depth limit, enabling a DoS via a crafted, deeply nested query update that can freeze the JavaS...

CVE-2025-66849

CVE-2025-66849 corresponds to a stored XSS in Ghost CMS (up to version 6.4.0). The vulnerability arises from improper sanitization/encoding of HTML in the post draft editor; a Contributor can inject JavaScript that executes with the Owner’s privileges when a draft is previewed, enabling an accoun...

CVE-2025-81110

CVE-2025-81110 affects Gogs prior to 0.13.0. The PutContents API fails to validate file types, enabling symlink injection that overwrites internal Git hooks (e.g., pre-receive). A subsequent push executes the compromised hook, potentially giving an authenticated attacker full control if RUN_USER ...

CVE-2026-40271

The connected documents indicate CVE-2026-40271 is being used as a fake CVE lure in Lazarus Group phishing campaigns (e.g., fake GitHub exploit page; Telegram PoC mentions). There are no concrete technical details about the vulnerability (affected product/version, root cause, impact, or fixes) pr...

CVE-2026-35678

CVE-2026-35678 is linked to a vulnerability in the Eduplus Student ERP platform, specifically an insecure direct object reference (IDOR) in the learner portal. The exploit document identifies the vulnerable endpoint as POST /ExamForm/viewSubmitExamForm (target host: learnerapi.pceterp.in and rela...

CVE-2026-30039

Technical details for CVE-2026-30039 are not publicly available in the provided documents; monitor for updates.

CVE-2026-31337

Technical details for CVE-2026-31337 are not provided in the supplied documents. The connected entry PT-2026-24209 does not specify this CVE’s affected products, impact, or remediation.

CVE-2026-00000

CVE-2026-00000 is a reserved placeholder with no public details in the Initial Document. The connected PT-2026-4731 reference mentions CVE-2026-00000 in the context of Clawdbots on the internet with open ports and no authentication, but does not specify affected products, versions, root cause, im...

CVE-2026-12345

The connected PTSecurity advisory PT-2026-3861 documents a critical remote code execution in NexusFlow API Gateway (versions prior to 3.8.1). The vulnerability is described as unauthenticated and actively exploited via the API, with a CVSS score of 10.0. Remediation advised: update to NexusFlow A...

CVE-2022-5678

Technical details for CVE-2022-5678 are not publicly available in the provided documents. Monitor for updates as new information may be added.

CVE-2025-13834

CVE-2025-13834 is a memory disclosure in the RFCOMM Bluetooth stack. Public details confirm an unauthenticated attacker within Bluetooth range can trigger an out-of-bounds read via a malformed RFCOMM TEST command, leaking up to 127 bytes of memory (e.g., phone numbers, credentials, kernel pointer...