CVE-2026-50488 Clipboard User Service Elevation of Privilege Vulnerability

...

CVE-2026-50488

CVE-2026-50488 affects Windows Clipboard User Service and is caused by improper neutralization of special elements in a command, enabling local privilege escalation for an authorized attacker. The CVSS v3.1 vector indicates local access, low attack complexity and privileges, with high impact to c...

CVE-2026-50488 Clipboard User Service Elevation of Privilege Vulnerability

...

CVE-2026-50421

CVE-2026-50421 is a Windows vulnerability in Windows Connected User Experiences and Telemetry described as a local privilege escalation via a resource access type confusion. The CVE entry is supported by multiple records: NVD/NCSC/CIRCL indicate the issue and Microsoft has released updates to add...

CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

...

CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

...

CVE-2026-50454

The CVE-2026-50454 entry describes a Privilege Elevation via Relative Path Traversal in Windows User Interface Core. Affected component: Windows User Interface Core; attack requires local access (LOCAL) with LOW privileges and no user interaction per the CVSS v3.1 vector. Impact is Elevation of P...

CVE-2026-50454 Windows User Interface Core Elevation of Privilege Vulnerability

...

CVE-2026-50454 Windows User Interface Core Elevation of Privilege Vulnerability

...

CVE-2026-50371 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

...

CVE-2026-50371

CVE-2026-50371 affects Windows LUAFV (Windows LUAFV driver). The issue is a race condition due to concurrent access to a shared resource without proper synchronization, enabling an authorized local attacker to elevate privileges. Microsoft has released updates addressing this family of vulnerabil...

CVE-2026-50425

CVE-2026-50425: A use-after-free in Windows Internal System User Profile leads to local privilege escalation for an authorized attacker. Affected component: Windows Internal System User Profile; root cause: use-after-free; impact: gain high privileges locally with no user interaction (CVSSv3.1: A...

CVE-2026-50425 Windows Internal System User Profile Elevation of Privilege Vulnerability

...

CVE-2026-50425 Windows Internal System User Profile Elevation of Privilege Vulnerability

...

CVE-2026-58595

CVE-2026-58595 concerns the Microsoft Bing App for iOS, where an improper restriction of rendered UI layers or frames enables an unauthorized attacker to spoof over a network. The vulnerability affects the Bing iOS app’s UI rendering stack (specific component not detailed in the provided document...

CVE-2026-15703 SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument userid results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-15703

CVE-2026-15703 affects SourceCodester Simple and Nice Shopping Cart Script 1.0. The vulnerability exists in /admin/userproductdeletequery.php where manipulating the user_id parameter enables SQL injection. It can be exploited remotely and the exploit is publicly available. CVSS metrics indicate h...

CVE-2026-23573

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability CWE-79 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5...

CVE-2026-55651

Easy!Appointments exposes an Excessive Data Exposure vulnerability in the customers search endpoint (affected in 1.5.2) that allows an authenticated user to obtain appointment hashes belonging to other users, enabling modification or deletion of others’ appointments and leading to an Appointments...

CVE-2026-55651 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointmen...