CVE-2026-84245: Improper Privilege Management

IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cpwrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files...

CVE-2026-107782: Incorrect Authorization

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-92555: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-107615: Uncontrolled Search Path Element

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...

CVE-2026-105079: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52...

CVE-2026-93509: Improper Input Validation

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-87680: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

PT-2026-107883

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-107322: Incomplete List of Disallowed Inputs

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

A Survey of Security Research for Operating Systems

In recent years, information systems have become the social infrastructure, so that their security must be improved urgently. In this paper, we introduce the results of the survey of virtualization, operating system verification and access control technologies in association with the design...

PT-2026-107847

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

PT-2026-107848

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

ROS-20261008-73-0036

The vulnerability in the drivers/crypto/ccp/sev-dev.c module of the Linux operating system is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

PT-2026-107811

Name of the Vulnerable Software and Affected Versions Brocade Fabric versions prior to 9.2.2d Brocade Fabric versions 10.0.0 through 10.0.0a1 Description Improper handling of specific download protocols allows for the use of unsanitized parameter strings. During the processing of upgrade requests...

PT-2026-107956

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88 Description A local authenticated user can execute arbitrary code with SYSTEM privileges due to an uncontrolled search path element. The DynamicLibrary::init function and ThemeLib...

NTFS Privilege Escalation

The vulnerability of the NTFS file system in Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

Windows Installer Privilege Escalation

The vulnerability of Windows operating system installers is related to the situation of a race between different actors. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-94244: Exposure of Sensitive Information to an Unauthorized Actor

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

PT-2026-107922

Name of the Vulnerable Software and Affected Versions MasterStudy LMS versions prior to 3.7.53 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are stored on the server a...

PT-2026-107846

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...