CVE-2026-110237: Unverified Ownership

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-54869: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1...

CVE-2026-72895: Use of Default Cryptographic Key

A vulnerability has been identified in SIMATIC IPC BX-21A All versions V31.01.13, SIMATIC IPC RW-543A All versions V1.1.4, SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G All versions V28.01.15. A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a...

CVE-2026-108966: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly...

CVE-2026-96937: Use After Free

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-83751: Use After Free

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

CVE-2026-69880: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in Desktop Window Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-84012: Double Free

Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-69880: Desktop Window Manager Elevation of Privilege Vulnerability

Access of resource using incompatible type 'type confusion' in Desktop Window Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-77375: Improper Validation of Array Index

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality o...

CVE-2026-97743: Use After Free

Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

CVE-2026-83695: Use of Uninitialized Resource

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-83872: Incorrect Conversion between Numeric Types

Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83872: Windows TCP/IP Local Elevation of Privilege Vulnerability

Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

CVE-2026-103821: Out-of-bounds Write

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-108495: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7...

Microsoft Windows: CVE-2026-83703: Windows Wi-Fi Driver Denial of Service Vulnerability

Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to deny service over an adjacent network...

CVE-2026-83958: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-93907: Improper Authentication

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler...

CVE-2026-102199: Stack-based Buffer Overflow

Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network...

CVE-2026-69783: External Control of File Name or Path

External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally...

CVE-2026-100205: Untrusted Pointer Dereference

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally...

CVE-2026-108489: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3...

Microsoft Windows: CVE-2026-85938: Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-96868: Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-54700: Improper Input Validation

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can...

CVE-2026-83658: Missing Authorization

Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally...

CVE-2026-110209: Missing Authorization

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config...

Microsoft Windows: CVE-2026-70166: Windows DNS Denial of Service Vulnerability

Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-69942: Windows Overlay Filter Remote Code Execution Vulnerability

Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally...

CVE-2026-88156: Stack-based Buffer Overflow

Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

CVE-2026-108376: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.getfielddefault inserts a schema-controlled referenced record name into the callable...

CVE-2026-108383: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.getfielddefault renders a schema-controlled enum field default as an enum member reference...

Microsoft Windows: CVE-2026-85840: Windows Event Viewer Information Disclosure Vulnerability

Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network...

CVE-2026-85323: Weak Authentication

Weak authentication in Network Device Enrollment Service NDES allows an authorized attacker to perform spoofing over a network...

CVE-2026-83642: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-109115: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql...

Microsoft Windows: CVE-2026-70201: Windows DHCP Server Denial of Service Vulnerability

Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service locally...

CVE-2026-88114: Untrusted Pointer Dereference

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-88096: Windows DCOM Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DCOM Server allows an authorized attacker to elevate privileges locally...

CVE-2025-58772: Buffer Copy without Checking Size of Input

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability...

CVE-2026-88116: Untrusted Pointer Dereference

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-88082: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally...

CVE-2026-69918: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96920: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72969: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72934: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69596: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69743: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88079: Windows MIDI Service Module Elevation of Privileges Vulnerability

Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...