PT-2026-88465

Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-88466

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-88133

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

PT-2026-88134

🚨 CVE-2026-83987 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. 🎖@cveNotify...

PT-2026-88478

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-88141

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

PT-2026-88479

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-88475

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-87838

Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack...

PT-2026-86968

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

PT-2026-87686

🚨Critical - Windows DNS Server Remote Code Execution via Use-After-Free CVE-2026-69730 A use-after-free in the Windows DNS Server service DNS.exe can be triggered remotely by sending crafted DNS requests over the network, corrupting memory and leading to arbitrary code execution as SYSTEM...

PT-2026-87989

🚨 CRITICAL: CVE-2026-78445 CVSS 9.8 Use-after-free in Windows Services for NFS ONCRPC XDR Driver enables unauthenticated RCE over network. No user interaction required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/L89LsUn6sU...

PT-2026-87719

Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network...

PT-2026-87409

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network...

PT-2026-87362

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network...

PT-2026-87607

Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally...

PT-2026-88335

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

PT-2026-87908

Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack...

PT-2026-88430

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

PT-2026-87731

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87701

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network...

PT-2026-87875

Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network...

PT-2026-87651

Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network...

PT-2026-88294

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

PT-2026-87977

Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

PT-2026-87646

Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally...

PT-2026-87648

News: Windows Kerberos CVE-2026-69676 CVSS 8.8 lets a low-priv domain user replay a crafted auth request and run code on a DC; Exploitation More Likely; patch DCs now. https://t.co/eME8i0s2er...

PT-2026-88117

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

PT-2026-87559

Out-of-bounds read in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

PT-2026-88020

Buffer over-read in Windows Storage allows an unauthorized attacker to disclose information with a physical attack...

PT-2026-87035

If a namespaced CR can mint cluster identity, that operator is a CA. If a namespaced CR can mint cluster identity, that operator is a CA. CVE-2026-78234, hawtio-operator. it reads the OpenShift Service CA private key, then issues a client cert with whatever CN you put on the Hawtio CR. the operat...

PT-2026-88545

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

PT-2026-86955

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

PT-2026-87923

Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...

PT-2026-87540

Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network...

PT-2026-87656

Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally...

PT-2026-87634

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

PT-2026-87426

Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally...

PT-2026-87761

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network...

PT-2026-87215

Improper neutralization of special elements in output used by a downstream component 'injection' in SQL Server allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87059

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth algo header value. When the algorithm cannot be mapped to a...

PT-2026-87166

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

PT-2026-87768

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network...

PT-2026-87060

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

PT-2026-87440

Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network...

PT-2026-87253

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

PT-2026-88161

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled sync ttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

PT-2026-87940

Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network...

PT-2026-87844

Use after free in Windows Internet Connection Sharing ICS allows an authorized attacker to elevate privileges locally...

PT-2026-88168

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...