CVE-2026-73243

kkFileView (Spring Boot-based) prior to version 5.0.1 is vulnerable to unauthenticated SSRF via GET /addTask. The issue arises because this endpoint was omitted from TrustHostFilter and TrustDirFilter in WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-controlled URL after FileH...

CVE-2026-48804 python-socketio: Binary attachment accumulation can cause denial of service

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

CVE-2026-68269

A flaw was found in the Linux kernel, specifically within the drm/i915/gem component. A local user could exploit a missing Spectre mitigation on a userspace-controlled parallel submission slot. This vulnerability allows for a side-channel attack, which could lead to the unauthorized disclosure of...

CVE-2026-20917

Exposure of sensitive information caused by incorrect data forwarding during transient execution for some IntelR Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable dat...

CVE-2026-48771 ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-69223

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-48483

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

CVE-2026-62917 Microsoft SharePoint Server Spoofing Vulnerability

...

CVE-2026-70326 Microsoft SharePoint Server Elevation of Privilege Vulnerability

...

CVE-2026-66805 Microsoft SharePoint Server Remote Code Execution Vulnerability

...

CVE-2026-66805

A CVE-2026-66805 entry exists with conflicting descriptions across sources. The connected Red Hat CVE details describe a flaw in the console component of a managed-cluster hub: an attacker who can write to container logs can inject malicious code into the hub console user’s browser session by vie...

CVE-2026-64901 Microsoft SharePoint Server Remote Code Execution Vulnerability

...

CVE-2026-64900 Microsoft SharePoint Server Spoofing Vulnerability

...

CVE-2026-64900 Microsoft SharePoint Server Spoofing Vulnerability

...

CVE-2026-59131

Summary: CVE-2026-59131 pertains to AMD Zen and is described as an information-disclosure vulnerability that can be exploited by an authorized, local attacker to disclose information. The available documents indicate a CVSS v3.1 base score of 5.6 (Medium) with LOCAL attack vector, HIGH confidenti...

CVE-2026-59131 AMD Zen Information Disclosure Vulnerability

...

CVE-2026-59131 AMD Zen Information Disclosure Vulnerability

...

EUVD-2026-56447

Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-65811

CVE-2026-65811 : This entry concerns Power BI with an issue described as improper input validation that allows an authorized attacker to execute code over a network. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8 (HIGH). Affected component and root cause are stated onl...

CVE-2026-65660

A code injection vulnerability exists in Microsoft SharePoint Server (on-premises versions 2016, 2019, and 2022) due to unescaped quote injection into Register directives . This flaw allows an authorized low-privilege user to bypass SafeControls validation and achieve remote code execution (RCE) ...