EUVD-2026-56665

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

EUVD-2026-56649

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-68815

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68795

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68794

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-56427

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network...

Microsoft Outlook Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Active Directory allows an unauthorized attacker to execute code over a network...

PT-2026-70533

Name of the Vulnerable Software and Affected Versions RPC Runtime affected versions not specified Description A heap-based buffer overflow in the RPC Runtime allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

PT-2026-70575

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A stack-based buffer overflow occurs wh...

PT-2026-70413

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description A heap-based buffer overflow occurs in the Remote Desktop Client, which allows an unauthorized attacker to execute arbitrary code over a network and affect the system. A...

CVE-2026-72584

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72571

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

EUVD-2026-55219

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

EUVD-2026-55228

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-72568

Red Hat CNA-LR concluded this CVE is not valid; no patch, advisory, or technical details are present in any connected document, so this CVE ID is rejected/not used and does not represent an active vulnerability entry.