412514 matches found
CVE-2026-83789: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-88076: NULL Pointer Dereference
Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-83569: Heap-based Buffer Overflow
Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally...
CVE-2026-49785: Improper Resource Shutdown or Release
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally...
CVE-2026-70257: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
CVE-2026-88186: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-88160: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
CVE-2026-84011: Incorrect Authorization
Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally...
CVE-2026-88197: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network...
CVE-2026-72968: Use After Free
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...
CVE-2026-72934: Use After Free
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...
CVE-2026-79610: Undefined Security Weakness
XSA-501 was about issues with v1 - v2 and v2 - v1 changes racing certain other grant table operations. Sadly a v2 - v1 - v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence...
Microsoft Windows: CVE-2026-85368: Windows TCP/IP Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally...
CVE-2026-96921: Access of Resource Using Incompatible Type
Access of resource using incompatible type 'type confusion' in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally...
CVE-2026-100135: Improper Input Validation
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...
CVE-2026-109662: Improper Neutralization of Input During Web Page Generation
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...
CVE-2026-109164: Authorization Bypass Through User-Controlled Key
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the...
CVE-2026-109252: NULL Pointer Dereference
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names...
CVE-2026-109267: Uncontrolled Recursion
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a...
CVE-2026-109272: NULL Pointer Dereference
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service...
CVE-2026-108788: Undefined Security Weakness
A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has...
CVE-2026-106495: Improper Access Control
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...
CVE-2026-103524: Undefined Security Weakness
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary...
CVE-2026-53997: Weak Password Recovery Mechanism for Forgotten Password
Netherman Portal del Hermano portaldelhermano.es before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all...
CVE-2026-53922: Stack-based Buffer Overflow
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...
CVE-2026-41210: Out-of-bounds Write
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...
CVE-2026-21138: Undefined Security Weakness
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications...
CVE-2026-21137: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...
CVE-2026-21139: Undefined Security Weakness
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...
CVE-2026-17475: Improper Authorization
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...
CVE-2026-44828: Insertion of Sensitive Information into Externally-Accessible File or Directory
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...
CVE-2026-41508: Protection Mechanism Failure
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...
CVE-2026-21133: Undefined Security Weakness
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...
CVE-2026-21130: Improper Input Validation
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...
CVE-2026-21131: Incorrect Default Permissions
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device...
CVE-2026-21132: Undefined Security Weakness
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability...
CVE-2026-21114: Out-of-bounds Write
Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...
CVE-2026-41510: Protection Mechanism Failure
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...
CVE-2026-21129: Improper Input Validation
Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...
CVE-2026-21128: Improper Input Validation
Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges...
CVE-2026-49484: Insecure Temporary File
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where...
CVE-2026-49483: Incorrect Permission Assignment for Critical Resource
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed...
CVE-2026-48211: Cross-Site Request Forgery (CSRF)
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...
CVE-2026-48212: Improper Neutralization of Input During Web Page Generation
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...
CVE-2026-21117: Undefined Security Weakness
Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information...
CVE-2026-21118: Undefined Security Weakness
Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...
CVE-2026-21116: Undefined Security Weakness
Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21115: Undefined Security Weakness
Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...