212496 matches found
PT-2026-87054
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client secret and code verifier parameters. Attackers can exploit PHP truthy evaluation logic, which...
PT-2026-88173
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...
PT-2026-88162
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...
PT-2026-88170
Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...
PT-2026-88522
The following issues are included in Project Mainline components. Subcomponent CVE ART CVE-2026-28664 Media Framework components CVE-2026-28609, CVE-2026-45527 Documents UI CVE-2026-28636 Media Codecs CVE-2026-28618, CVE-2026-55294 Media Provider CVE-2026-28622, CVE-2026-28638, CVE-2026-28671,...
PT-2026-87703
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-87869
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally...
PT-2026-88609
Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Low...
PT-2026-87881
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...
PT-2026-87083
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects...
PT-2026-88015
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-87905
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
PT-2026-87366
Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network...
PT-2026-88044
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...
PT-2026-88088
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
PT-2026-88089
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
PT-2026-88091
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
PT-2026-88068
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
PT-2026-88078
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
PT-2026-88473
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PT-2026-88139
A new vulnerability with increased severity was disclosed for Microsoft Windows CVE-2026-83992 https://t.co/cvnfBMK8uB...
PT-2026-87848
Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an authorized attacker to execute code locally...
PT-2026-87467
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network...
PT-2026-87712
Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network...
PT-2026-87190
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...
PT-2026-87667
Integer overflow or wraparound in Windows USB Audio Class driver usbaudio.sys allows an authorized attacker to elevate privileges locally...
PT-2026-87491
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
PT-2026-88567
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...
PT-2026-88252
In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-87876
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally...
PT-2026-86991
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
PT-2026-88013
This Microsoft Patch Tuesday, among with the historical 974 ! bugs patched, I contributed three. - Microsoft Word Remote Code Execution Vulnerability CVE-2026-78510 https://t.co/7UyCIwJTji - Microsoft Office Outlook Remote Code Execution Vulnerability CVE-2026-78509 https://t.co/Nn3oKfDPL4 -...
PT-2026-88241
In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...
PT-2026-87324
Integer underflow wrap or wraparound in Microsoft UxTheme Library uxtheme.dll allows an unauthorized attacker to execute code over a network...
PT-2026-88556
Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
PT-2026-87248
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network...
PT-2026-87814
Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker to disclose information over a network...
PT-2026-87444
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
PT-2026-87572
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...
PT-2026-88355
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
PT-2026-87301
Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to deny service over a network...
PT-2026-87974
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally...
PT-2026-86985
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli query of the file /pages/us searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...
PT-2026-87805
Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...
PT-2026-86970
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security...
PT-2026-88557
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...
PT-2026-88431
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
PT-2026-87391
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...
PT-2026-87111
L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...