212496 matches found
PT-2026-88663
Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PT-2026-88033
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
PT-2026-87382
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...
PT-2026-87441
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally...
PT-2026-87182
A NULL Pointer Dereference vulnerability CWE-476 vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all...
PT-2026-87230
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
PT-2026-87341
Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...
PT-2026-87879
Missing authentication for critical function in Windows Internet Connection Sharing ICS allows an authorized attacker to perform tampering locally...
PT-2026-87468
Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network...
PT-2026-87001
A vulnerability has been identified in Desigo CC ClickOnce Client V6 All versions, Desigo CC ClickOnce Client V7 All versions, Desigo CC family V8 All versions, Desigo CC family V9 All versions, Desigo CC Flex Client V6 All versions, Desigo CC Flex Client V7 All versions, Desigo CC Installed Clie...
PT-2026-88458
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...
PT-2026-88175
Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...
PT-2026-87755
We have just added an important vulnerability affecting Microsoft Windows CVE-2026-69845 https://t.co/ulFX3mqvL1...
PT-2026-87192
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...
PT-2026-87436
Use after free in Audio Video Control Transport Protocol allows an authorized attacker to elevate privileges locally...
PT-2026-88277
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...
PT-2026-87672
Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network...
PT-2026-88278
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...
PT-2026-88155
A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. Th...
PT-2026-87655
Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally...
PT-2026-88147
Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...
PT-2026-87141
A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...
PT-2026-87832
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally...
PT-2026-87446
CVE-2026-69412 scores 8.0. • Stack-based buffer overflow in Windows DHCP Server • Allows authenticated adjacent-network RCE • Affects Windows 10 1607 • Exploitation considered unlikely, no known attacks https://t.co/fOP7ghPmwg https://t.co/G99ODACz6v...
PT-2026-87080
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel...
PT-2026-87799
Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...
PT-2026-87223
Improper link resolution before file access 'link following' in SQL Server allows an authorized attacker to elevate privileges over a network...
PT-2026-87252
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...
PT-2026-88500
Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...
PT-2026-88516
Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration —...
PT-2026-88434
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...
PT-2026-87846
Use after free in Windows DNS allows an authorized attacker to execute code over a network...
PT-2026-87931
Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...
PT-2026-87178
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via...
PT-2026-88073
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
PT-2026-88072
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
PT-2026-88075
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
PT-2026-88447
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node 1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false...
PT-2026-88085
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user...
PT-2026-88106
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...
PT-2026-88103
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...
PT-2026-87660
Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges over a network...
PT-2026-87533
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally...
PT-2026-87576
Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network...
PT-2026-87610
Integer overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
PT-2026-87623
Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally...
PT-2026-87278
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally...
PT-2026-87297
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally...