CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-65789

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network...

CVE-2026-64912

Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally...

CVE-2026-62820

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DNS allows an unauthorized attacker to execute code over a network...

EUVD-2026-56773

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...

EUVD-2026-56770

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally...

EUVD-2026-56709

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...

EUVD-2026-56665

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

EUVD-2026-56649

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-68815

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68795

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68794

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-56427

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network...

Microsoft Outlook Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Active Directory allows an unauthorized attacker to execute code over a network...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

PT-2026-70533

Name of the Vulnerable Software and Affected Versions RPC Runtime affected versions not specified Description A heap-based buffer overflow in the RPC Runtime allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs...

PT-2026-70413

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description A heap-based buffer overflow occurs in the Remote Desktop Client, which allows an unauthorized attacker to execute arbitrary code over a network and affect the system. A...