CVE-2026-69735

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69735

A use after free vulnerability in the Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally . The flaw resides in the service's memory management, where a freed object is referenced again, enabling a local user with low privileges to escalate to higher acc...

CVE-2026-69735: Use After Free

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

MAL-2026-13628 Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

MAL-2026-12311 Malicious code in streak-calc-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d [email protected] is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the...

Malicious code in streak-calc-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d [email protected] is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the...

EUVD-2026-44099

Improper neutralization of special elements used in a command 'command injection' in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-50488 Clipboard User Service Elevation of Privilege Vulnerability

...

CVE-2026-50488

CVE-2026-50488 affects Windows Clipboard User Service and is caused by improper neutralization of special elements in a command, enabling local privilege escalation for an authorized attacker. The CVSS v3.1 vector indicates local access, low attack complexity and privileges, with high impact to c...

CVE-2026-50488 Clipboard User Service Elevation of Privilege Vulnerability

...

Clipboard User Service Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-50488: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally...

PT-2026-59242

Summary lemur.users.service.update writes a user's new password as plaintext to the users.password column. The User model wires bcrypt hashing to SQLAlchemy's before insert event but registers no equivalent listener for before update, and service.update does not call user.hash password after...

GHSA-Q437-G7FV-2JVV Lemur user-update path stores plaintext passwords

Summary lemur.users.service.update writes a user's new password as plaintext to the users.password column. The User model wires bcrypt hashing to SQLAlchemy's beforeinsert event but registers no equivalent listener for beforeupdate, and service.update does not call user.hashpassword after assigni...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites is related to access control errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

EUVD-2026-37328

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: End User Self Service. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Identity...

MAL-2026-5538 Malicious code in hex-type (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7d0271fe97ea66e9ff2ba3a0ea225364324f28138af32c337d6ed8b2b99e5ad Package metadata description "A universally-unique, lexicographically-sortable, identifier generator", homepage github.com/ulid/javascript, build...

CVE-2026-46705

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSHMSGUSERAUTHREQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user nam...