412465 matches found
CVE-2026-110254 Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses...
CVE-2026-110112 Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...
CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...
CVE-2026-110111 Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...
CVE-2026-102599 Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious...
CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Gi...
CVE-2026-105016 Microsoft QUIC Remote Code Execution Vulnerability
...
CVE-2026-108463 Windows SmartScreen Security Feature Bypass Vulnerability
...
CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
...
CVE-2026-108135 Windows Backup Engine Elevation of Privilege Vulnerability
...
CVE-2026-108133 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
...
CVE-2026-108136 Microsoft Windows Search Component Elevation of Privilege Vulnerability
...
CVE-2026-108134 Windows Autopilot Elevation of Privilege Vulnerability
...
CVE-2026-97781 Microsoft Office OneNote Remote Code Execution Vulnerability
...
CVE-2026-97801 .NET Framework Tampering Vulnerability
...
CVE-2026-108132 Windows Kerberos Elevation of Privilege Vulnerability
...
CVE-2026-108131 Active Directory Federation Services (AD FS) Spoofing Vulnerability
...
CVE-2026-108129 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-108130 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
...
CVE-2026-97841 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97844 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97843 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97840 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97839 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97842 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-108128 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-108127 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97837 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97831 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97828 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97836 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97832 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97827 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97835 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97833 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97834 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97838 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97830 Windows Internet Information Services Denial of Service Vulnerability
...
CVE-2026-97829 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97817 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97816 Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
...
CVE-2026-97819 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97820 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97815 Windows Error Reporting Remote Code Execution Vulnerability
...
CVE-2026-97814 Windows Text Shaping Remote Code Execution Vulnerability
...
CVE-2026-97813 Windows Hyper-V Information Disclosure Vulnerability
...
CVE-2026-97825 Role: DNS Server Information Disclosure Vulnerability
...
CVE-2026-97823 Role: DNS Server Information Disclosure Vulnerability
...