CVE-2026-50388

CVE-2026-50388 is an Windows NTFS local vulnerability described as an out-of-bounds read that allows an unauthenticated/unauthorized attacker to execute code locally. The CVE is tracked across multiple sources (NVD, MSRC, CIRCL) with a base CVSS v3.1 score of 7.8 (High) and LOCAL attack vector, r...

CVE-2026-50309 Windows NTFS Remote Code Execution Vulnerability

...

CVE-2026-50386

CVE-2026-50386 refers to a heap-based buffer overflow in Windows NTFS that allows an unauthorized attacker to execute code locally. The vulnerability affects Windows NTFS components as described in authoritative sources (NVD entry and MSRC update guidance). The exploitation detail in the provided...

CVE-2026-49789 Windows NTFS Elevation of Privilege Vulnerability

...

CVE-2026-49184 Windows NTFS Remote Code Execution Vulnerability

...

PT-2026-58283

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally...

PT-2026-58307

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally...

Security Bulletin: Multiple vulnerabbilities exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager.

Summary IBM Tivoli Network Configuration Manager is affected by multiple security vulnerabilities in IBM SDK, Java Technology Edition. This bulletin addresses the IBM SDK, Java Technology Edition Quarterly Critical Patch Update CPU for April 2026, which includes Oracle's April 2026 Critical Patch...

EUVD-2025-210451

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

PT-2026-57227

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

CVE-2026-4256

The CVE-2026-4256 entry concerns an LDAP injection vulnerability in PEAKUP Technology Inc. PassGate. The flaw arises from improper neutralization of special elements used in LDAP queries, allowing LDAP Injection. Affected product: PassGate, affected through version 30042026. CVSS3.1 metrics indic...

EUVD-2026-42586

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026...

CVE-2026-4256

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026...

CVE-2026-4256 LDAP Injection in PEAKUP's PassGate

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026...

CVE-2026-5005: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Twiser Informatics Technology Consulting, Trade and Education Inc. OKRs & Goals allows Stored XSS. This issue affects OKRs & Goals: from 28220 before 28398...

PT-2026-56761

Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

Important: Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysi...

SUSE CVE-2026-14020

Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security MOIS has been wielding a previously undocumented modular command-and-control C2 framework dubbed Cavern aka Cav3rn targeting Israeli organizations. The activity, which has primarily singled out IT providers and...

CVE-2026-41434

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS11 TA. Version 4.11.0 contains a patch. ...