212496 matches found
PT-2026-87187
Four critical CVEs all stemming from the same fundamental flaw: implicit trust in software components. The OX research team disclosed these vulnerabilities, which share a root cause of insufficient validation of third-party or AI-generated code, leading to sandbox escapes and arbitrary code...
PT-2026-87523
Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...
PT-2026-87158
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable...
PT-2026-87542
Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...
PT-2026-87426
Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally...
PT-2026-87707
Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally...
PT-2026-87109
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...
PT-2026-87684
šØ CVE-2026-69727 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. š@cveNotify...
PT-2026-87878
Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally...
PT-2026-87390
Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network...
PT-2026-87652
šØ HIGH SEVERITY: CVE-2026-69681 CVSS 8.0 Heap buffer overflow in Virtual Hard Disk VHD Miniport Driver enables privilege escalation via network. Authorized attacker required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/QbIbJXhzbo...
PT-2026-88291
A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger th...
PT-2026-88052
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...
PT-2026-87536
Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally...
PT-2026-87166
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...
PT-2026-87147
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...
PT-2026-88476
šØ CVE-2026-81977 Acrobat Reader is affected by an Integer Underflow Wrap or Wraparound vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a...
PT-2026-87937
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network...
PT-2026-88028
Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a network...
PT-2026-87891
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally...
PT-2026-87055
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an...
PT-2026-88494
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed...
PT-2026-87835
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally...
PT-2026-87670
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Hello allows an authorized attacker to elevate privileges locally...
PT-2026-88135
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
PT-2026-87766
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...
PT-2026-87833
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to disclose information locally...
PT-2026-87922
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network...
PT-2026-87513
Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network...
PT-2026-88407
šØ CVE-2026-75722 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires use...
PT-2026-87616
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...
PT-2026-87730
Time-of-check time-of-use toctou race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
PT-2026-87632
Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to deny service over a network...
PT-2026-87715
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network...
PT-2026-87650
Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network...
PT-2026-87204
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally...
PT-2026-87310
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
PT-2026-87545
Unintended proxy or intermediary 'confused deputy' in Microsoft Windows Speech allows an authorized attacker to perform tampering locally...
PT-2026-87048
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe...
PT-2026-87046
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
PT-2026-88457
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...
PT-2026-88140
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally...
PT-2026-87038
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...
PT-2026-87364
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Video Driver allows an authorized attacker to elevate privileges locally...
PT-2026-88213
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-87321
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
PT-2026-88222
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-88439
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
PT-2026-88228
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...