212496 matches found
PT-2026-87987
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network...
PT-2026-88441
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
PT-2026-88006
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...
PT-2026-88164
In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...
PT-2026-87225
🛡️ SQL Server’s “authorized user” can potentially turn a network connection into sysadmin access. CVE-2026-67370 is a reminder that database permissions are not a security strategy—patch now. https://t.co/kqYIHEbddp MicrosoftSecurity Msrc Cve202667370 https://t.co/yPfN0qbIFU...
PT-2026-87001
A vulnerability has been identified in Desigo CC ClickOnce Client V6 All versions, Desigo CC ClickOnce Client V7 All versions, Desigo CC family V8 All versions, Desigo CC family V9 All versions, Desigo CC Flex Client V6 All versions, Desigo CC Flex Client V7 All versions, Desigo CC Installed Clie...
PT-2026-87004
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...
PT-2026-88535
Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
PT-2026-87014
OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, fr...
PT-2026-87016
NuBrowser lacks protocol whitelist validation for the S.browser fallback url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websit...
PT-2026-87539
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
PT-2026-88066
Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...
PT-2026-87757
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network...
PT-2026-87850
Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network...
PT-2026-87682
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
PT-2026-88525
Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current Release CR, before 2507.1 LTSR CU3, and before LTSR 2607...
PT-2026-88509
Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the...
PT-2026-87165
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...
PT-2026-87955
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network...
PT-2026-87797
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
PT-2026-87116
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users id from $ REQUEST and invokes User::swapUser without calling...
PT-2026-87489
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network...
PT-2026-87918
Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...
PT-2026-89111
These are all security issues fixed in the python313-geopy-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-88253
In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-87334
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
PT-2026-86952
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...
PT-2026-87775
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally...
PT-2026-88430
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...
PT-2026-87034
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...
PT-2026-87377
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network...
PT-2026-88671
Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...
PT-2026-87863
🚨 HIGH severity CVE-2026-72946 CVSS 7.8: Heap-based buffer overflow in Storage Port Driver enables local privilege escalation. Authorized attackers can achieve full system compromise. Patch immediately. CVE Vulnerability PatchNow ThreatIntel CyberSecurity https://t.co/9ToPKItkAx...
PT-2026-87793
Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally...
PT-2026-88277
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...
PT-2026-87026
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout custom css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-88160
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...
PT-2026-87269
Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally...
PT-2026-87558
Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...
PT-2026-87170
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator ...
PT-2026-86950
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...
PT-2026-87897
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network...
PT-2026-88064
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
PT-2026-87563
Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...
PT-2026-87588
Incorrect type conversion or cast in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
PT-2026-87694
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally...
PT-2026-88306
ColdFusion is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user...
PT-2026-87731
External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...
PT-2026-87661
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...