414110 matches found
CVE-2026-70264: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Microsoft Defender allows an authorized attacker to disclose information locally...
CVE-2026-108496: Missing Authorization
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23...
CVE-2026-88180: Out-of-bounds Read
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...
CVE-2026-69640: Incorrect Authorization
Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network...
CVE-2026-83691: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally...
CVE-2026-96310: Use After Free
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-65131: Missing Authentication for Critical Function
NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service...
CVE-2026-69982: Weak Authentication
Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-70189: Heap-based Buffer Overflow
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally...
CVE-2026-103851: Stack-based Buffer Overflow
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-110232: Improper Limitation of a Pathname to a Restricted Directory
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../ x/file to create or overwrite files in sibling folder...
CVE-2026-18228: Improper Limitation of a Pathname to a Restricted Directory
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents...
CVE-2026-109106: Improper Limitation of a Pathname to a Restricted Directory
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument displayname results in path traversal. The attack is only possible with local...
CVE-2026-102218: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...
CVE-2026-106035: Insertion of Sensitive Information into Log File
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...
CVE-2026-102859: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-102216: Access of Resource Using Incompatible Type
Access of resource using incompatible type 'type confusion' in Windows StateRepository API allows an authorized attacker to elevate privileges locally...
CVE-2026-88185: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-70132: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-96927: Out-of-bounds Read
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-69949: Windows Client for NFS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally...
CVE-2026-106631: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...
Microsoft Windows: CVE-2026-70218: Windows StateRepository API Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-97798: Windows Error Reporting Service Elevation of Privilege Vulnerability
Improper neutralization of argument delimiters in a command 'argument injection' in Windows Error Reporting allows an authorized attacker to elevate privileges locally...
CVE-2026-83713: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Out-of-bounds read in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to disclose information locally...
CVE-2026-85841: Use After Free
Use after free in Windows DHCP Server allows an authorized attacker to execute code over a network...
CVE-2026-102074: Stack-based Buffer Overflow
A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...
CVE-2026-83794: Out-of-bounds Read
Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized attacker to disclose information locally...
CVE-2026-85357: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Phone Service allows an authorized attacker to elevate privileges locally...
CVE-2026-85865: Authentication Bypass Using an Alternate Path or Channel
Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally...
CVE-2026-96119: Improper Control of Generation of Code
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...
CVE-2026-70199: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-69471: Windows Installer Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-83855: Integer Underflow (Wrap or Wraparound)
Integer underflow wrap or wraparound in Windows WLAN Service allows an unauthorized attacker to deny service over a network...
CVE-2026-63163: Authorization Bypass Through User-Controlled Key
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5filename token instead of passing a proper authorization check. Attackers can guess or determi...
CVE-2026-74043: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...
CVE-2026-96946: Use After Free
Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-102187: Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally...
CVE-2026-77095: NULL Pointer Dereference
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale...
CVE-2026-70302: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-85828: Heap-based Buffer Overflow
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-83917: Windows ALPC Elevation of Privilege Vulnerability
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally...
CVE-2026-70055: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
CVE-2026-105898: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a...
CVE-2026-105901: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...
CVE-2026-105903: Improper Control of Generation of Code
ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...
CVE-2026-106089: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...
CVE-2026-106090: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...
CVE-2026-105994: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...