CVE-2026-69627: Out-of-bounds Read

Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authorized attacker to disclose information locally...

CVE-2026-72954: Use After Free

Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network...

CVE-2026-69805: External Control of File Name or Path

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-74239: Improper Limitation of a Pathname to a Restricted Directory

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-69603: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-69606: Use After Free

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-76968: Exposure of Sensitive System Information to an Unauthorized Control Sphere

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

CVE-2026-77908: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

CVE-2026-68893: Use After Free

Use after free in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges over a network...

CVE-2026-73312: Authentication Bypass by Capture-replay

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate...

CVE-2026-12648: Deserialization of Untrusted Data

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-81822: Use of a Broken or Risky Cryptographic Algorithm

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user...

CVE-2026-69601: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network...

CVE-2026-62648: Out-of-bounds Write

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an...

CVE-2026-86431: Improper Neutralization of Input During Web Page Generation

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

CVE-2026-86484: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-20500: Improper Certificate Validation

In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01810811; Issue ID: MSV-9232...

CVE-2026-86296: Stack-based Buffer Overflow

A vulnerability was determined in D-Link DIR-822A A101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicl...

CVE-2026-86301: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

CVE-2026-86289: Integer Overflow or Wraparound

A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public...

CVE-2026-86490: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

CVE-2026-86505: Insertion of Sensitive Information Into Sent Data

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...

CVE-2026-86427: Improper Neutralization of Special Elements used in a Command

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graphtitle parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized...

CVE-2026-86452: Uncontrolled Resource Consumption

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...

CVE-2026-86495: Missing Authorization

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects...

CVE-2026-86237: Server-Side Request Forgery (SSRF)

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...

CVE-2026-86432: Asymmetric Resource Consumption (Amplification)

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausti...

CVE-2026-86315: Numeric Truncation Error

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16MA...

CVE-2021-48007: Improper Input Validation

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

CVE-2026-83534: Execution with Unnecessary Privileges

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-18056: Improper Authentication

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-86187: Use of Insufficiently Random Values

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-81348: Exposure of Sensitive Information to an Unauthorized Actor

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-86196: Authentication Bypass by Spoofing

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious...

CVE-2026-84930: Improper Neutralization of Input During Web Page Generation

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2026-16649: Improper Neutralization of Input During Web Page Generation

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-86174: Authorization Bypass Through User-Controlled Key

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-84931: Improper Neutralization of Input During Web Page Generation

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-86186: Improper Restriction of Excessive Authentication Attempts

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-85700: Insufficiently Protected Credentials

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-84504: Improper Input Validation

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-78328: Missing Authorization

A missing authorization vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin...

CVE-2026-61686: Deserialization of Untrusted Data

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-85608: Server-Side Request Forgery (SSRF)

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...

CVE-2026-19649: Insertion of Sensitive Information into Log File

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials...

CVE-2026-80112: Incorrect Permission Assignment for Critical Resource

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...

CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

CVE-2026-85596: Improper Authentication

Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...

CVE-2026-44402: Unrestricted Upload of File with Dangerous Type

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...

CVE-2026-85528: Improper Input Validation

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...