212496 matches found
PT-2026-88174
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...
PT-2026-88167
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...
PT-2026-88165
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...
PT-2026-88172
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...
PT-2026-88023
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
PT-2026-88682
Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
PT-2026-88154
A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...
PT-2026-88112
Heap-based buffer overflow in Windows Resilient File System ReFS allows an authorized attacker to elevate privileges locally...
PT-2026-88411
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...
PT-2026-88393
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
PT-2026-88230
In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-88218
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-88048
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...
PT-2026-88462
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...
PT-2026-88042
Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally...
PT-2026-88445
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...
PT-2026-88290
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...
PT-2026-88595
Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PT-2026-88657
Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...
PT-2026-87615
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...
PT-2026-87312
Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network...
PT-2026-87605
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally...
PT-2026-88016
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-87993
Use after free in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over a network...
PT-2026-88027
Use after free in Windows DNS allows an unauthorized attacker to deny service over a network...
PT-2026-88010
Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally...
PT-2026-87771
Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network...
PT-2026-88756
Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...
PT-2026-87136
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...
PT-2026-87172
An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...
PT-2026-87167
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...
PT-2026-87874
Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...
PT-2026-87892
Use after free in IP Helper allows an unauthorized attacker to execute code over a network...
PT-2026-87237
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network...
PT-2026-88286
Integer underflow wrap or wraparound in Skype for Business allows an unauthorized attacker to deny service over a network...
PT-2026-87594
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network...
PT-2026-87601
Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network...
PT-2026-87988
🚨 HIGH: CVE-2026-78444 CVSS 8.1 Untrusted pointer dereference in Windows Failover Cluster enables remote code execution over network. No authentication required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/JlgAg4R9uL...
PT-2026-87211
Heap-based buffer overflow in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
PT-2026-87705
Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network...
PT-2026-87221
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
PT-2026-87276
Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network...
PT-2026-87808
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
PT-2026-87493
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...
PT-2026-87231
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network...
PT-2026-87726
🚨 HIGH SEVERITY: CVE-2026-69797 CVSS 8.8 Use-after-free flaw in Microsoft Office PowerPoint enables remote code execution. Network-based attack, no privileges required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/l8ziCwoJnc...
PT-2026-87720
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
PT-2026-87649
🚨 HIGH SEVERITY: CVE-2026-69678 CVSS 8.8 Use-after-free flaw in Microsoft Office PowerPoint enables remote code execution. Attacker requires user interaction. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/CpB18QSCQG...
PT-2026-87627
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network...
PT-2026-87704
🚨 HIGH SEVERITY: CVE-2026-69767 CVSS 8.8 Use-after-free in MS Office PowerPoint enables remote code execution. Network-based attack, no privileges required. Patch immediately. CVE Vulnerability PatchNow https://t.co/Z8mtFG8Rrb...