414830 matches found
CVE-2026-104922: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Microsoft Windows: CVE-2026-88127: Windows SMB Server Elevation of Privilege Vulnerability
Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally...
CVE-2026-18318: Improper Restriction of Excessive Authentication Attempts
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...
CVE-2026-103841: Out-of-bounds Read
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this...
Microsoft Windows: CVE-2026-96934: Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network...
CVE-2026-85925: Improper Restriction of Communication Channel to Intended Endpoints
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network...
CVE-2026-70085: Missing Authorization
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...
Microsoft SharePoint: CVE-2026-85932: Microsoft Office SharePoint Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
CVE-2026-85918: Use After Free
Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-85918: Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...
CVE-2026-83680: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-85806: Integer Underflow (Wrap or Wraparound)
Integer underflow wrap or wraparound in Network Policy Server NPS allows an unauthorized attacker to execute code over a network...
CVE-2026-100217: Missing Authorization
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-69945: Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally...
CVE-2026-83694: Out-of-bounds Read
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-110255: Server-Side Request Forgery (SSRF)
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...
CVE-2026-103842: Out-of-bounds Read
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this...
CVE-2026-83754: Heap-based Buffer Overflow
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network...
CVE-2026-105443: Improper Access Control
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install...
CVE-2026-109523: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...
CVE-2026-110106: Authorization Bypass Through User-Controlled Key
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...
CVE-2026-70167: Access of Resource Using Incompatible Type
Access of resource using incompatible type 'type confusion' in DNS Server allows an authorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-83692: Windows Bind Filter Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-85943: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use toctou race condition in Reliable Multicast Transport Driver RMCAST allows an authorized attacker to elevate privileges locally...
CVE-2026-100210: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-97746: Microsoft Office Excel Remote Code Execution Vulnerability
Integer underflow wrap or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
CVE-2026-83583: Missing Authorization
Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally...
CVE-2026-88159: Out-of-bounds Read
Use after free in Windows Background Intelligent Transfer Service BITS allows an unauthorized attacker to execute code over a network...
CVE-2026-70021: Use After Free
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally...
CVE-2026-83707: Use After Free
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-70212: Windows Security Center Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally...
CVE-2026-83753: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally...
CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...
CVE-2026-109156: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
Microsoft Windows: CVE-2026-85812: Windows Bind Filter Driver Information Disclosure Vulnerability
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-96300: RPC Endpoint Mapper Service Denial of Service Vulnerability
Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network...
CVE-2026-109521: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be...
CVE-2026-104661: Incorrect Privilege Assignment
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure a...
Microsoft Windows: CVE-2026-83767: Windows Installer Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-110214: Use of Hard-coded Cryptographic Key
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...
CVE-2026-110077: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
Microsoft Windows: CVE-2026-69947: Windows Overlay Filter Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack...
Microsoft Windows: CVE-2026-69997: Remote Desktop Client Remote Code Execution Vulnerability
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-96320: Windows DHCP Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...
CVE-2026-65172: Missing Authorization
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may...
CVE-2026-53420: Buffer Copy without Checking Size of Input
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access...
CVE-2026-105902: Uncontrolled Resource Consumption
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...
CVE-2026-70163: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network...