212496 matches found
PT-2026-88592
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
PT-2026-88061
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...
PT-2026-88233
In LimitRealloc of malloc limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-87132
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...
PT-2026-87990
Use after free in Windows Distributed File System DFS allows an authorized attacker to deny service over a network...
PT-2026-87356
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally...
PT-2026-88513
Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...
PT-2026-87659
Heap-based buffer overflow in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges over a network...
PT-2026-87128
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...
PT-2026-88039
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-87753
Heap-based buffer overflow in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges locally...
PT-2026-87592
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
PT-2026-87519
Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over a network...
PT-2026-87842
Double free in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...
PT-2026-87213
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...
PT-2026-88159
Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...
PT-2026-88036
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
PT-2026-87880
Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally...
PT-2026-88499
Impact Two stages of expression code generation built source text by calling the global JSON.stringify at generation time: the compiler when printing synthetic string literals, and the isolate bridge when interpolating a timezone value into its per-evaluation wrapper. An expression that replaced...
PT-2026-88604
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: Medium...
PT-2026-88002
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-88505
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...
PT-2026-88146
Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network...
PT-2026-87900
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
PT-2026-88632
Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...
PT-2026-87450
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
PT-2026-87752
Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network...
PT-2026-87676
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
PT-2026-87134
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
PT-2026-88132
🚨 CVE-2026-83985 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. 🎖@cveNotify...
PT-2026-87882
Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...
PT-2026-87981
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...
PT-2026-87041
Uncontrolled recursion in Qt's QDomDocument serialization QtXml lets deeply nested untrusted XML crash the app via stack exhaustion DoS only...
PT-2026-87645
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-87647
Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to bypass a security feature locally...
PT-2026-87679
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...
PT-2026-87305
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally...
PT-2026-87792
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network...
PT-2026-87826
Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally...
PT-2026-88730
Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
PT-2026-88432
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...
PT-2026-88741
Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...
PT-2026-87518
Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network...
PT-2026-87744
Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally...
PT-2026-87966
Access of resource using incompatible type 'type confusion' in Windows DHCP Server allows an unauthorized attacker to deny service over a network...
PT-2026-87546
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally...
PT-2026-87338
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...
PT-2026-87767
Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally...
PT-2026-87000
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...