CVE-2026-69226

A security flaw in Portal for ArcGIS allows unauthenticated users to create new accounts via the sharing endpoint. The vulnerability occurs because the application fails to enforce restrictions even when self-service account registration is disabled (disableSignup=true ). An attacker can bypass t...

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Internet Connection Sharing ICS allows an authorized attacker to execute code over an adjacent network...

CVE-2026-69226: Incorrect Authorization

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled disableSignup=true. An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized...

CVE-2026-85856: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Internet Connection Sharing ICS allows an authorized attacker to execute code over an adjacent network...

PT-2026-112817

Name of the Vulnerable Software and Affected Versions Windows Internet Connection Sharing ICS affected versions not specified Description A heap-based buffer overflow occurs in Windows Internet Connection Sharing ICS, which allows an authorized attacker to execute arbitrary code over an adjacent...

Microsoft Windows: CVE-2026-85856: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Internet Connection Sharing ICS allows an authorized attacker to execute code over an adjacent network...

openwifipass

OpenWifiPass Una implementación de código abierto del rol de otorgante en el protocolo de Compartir Contraseña Wi-Fi de Apple. Descargo de responsabilidad OpenWifiPass es un software experimental y es el resultado de esfuerzos de ingeniería inversa por parte del proyecto Open Wireless Link. El...

ttyd

ttyd - Comparte tu terminal a través de la web ttyd es una herramienta simple de línea de comandos para compartir la terminal a través de la web. Características Construido sobre libuv y WebGL2 para velocidad Terminal completamente funcional con soporte para CJK e IME Soporte de transferencia de...

pwndrop

pwndrop es un servicio de alojamiento de archivos autodesplegable para enviar cargas útiles de red team o compartir de forma segura tus archivos privados a través de HTTP y WebDAV. Si alguna vez has necesitado configurar rápidamente un servidor web nginx/apache para alojar tus archivos y nunca...

PT-2026-109669

Name of the Vulnerable Software and Affected Versions PairDrop versions prior to 1.11.3 Description An IP spoofing issue exists in the Peer. setIP function. Remote attackers can join discovery rooms of other networks by providing a forged cf-connecting-ip header. On self-hosted instances not...

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...

Data Sharing Service Windows Privilege Escalation

The vulnerability of the Data Sharing Service client for the Windows operating system is related to the lack of authentication. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-107230

The AsyncHttpClient (AHC) Java library, from version 2.0.0 until 3.0.14 , contains a vulnerability where connection-pool partitioning fails to omit identity-defining fields for Kerberos, SPNEGO, NTLM , and authenticated proxy connections. This flaw allows logins lacking configured principals, pro...

PT-2026-107497

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing group id, the internal before-save ho...

macOS 27.x < 27.0 Multiple Vulnerabilities (149035)

The remote host is running a version of macOS / Mac OS X that is 27.x prior to the full release of 27.0. It is, therefore, affected by multiple vulnerabilities: - A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

Linux block and network PV device frontends do not zero memory regions before sharing them with the backend CVE-2022-26365, CVE-2022-33740. Additionally, the granularity of the grant table does not allow sharing smaller than a 4K page, resulting in unrelated data residing in the same 4K page as...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.114, using "After Free" in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page and user gestures...

Astra Linux – Vulnerability in Chromium

Before version 89.0.4389.114, using screen sharing in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed UAF in async decryption Performing async decryption large read results in a crash due to a slabuseafterfree issue in the crypto API. Reproducing the issue: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: llc: Do not use skbget before devqueuexmit. The syzbot exploit can cause hosts to crash, especially when using llc and devices that do not support IFFTXSKBSHARING. In this case, the e1000 driver calls ethskbpad, where the skb is...