414110 matches found
CVE-2026-58242: Integer Underflow (Wrap or Wraparound)
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information...
Microsoft Windows: CVE-2026-88143: Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...
CVE-2026-83786: Generation of Error Message Containing Sensitive Information
Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-70238: Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...
CVE-2026-83958: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-85820: Heap-based Buffer Overflow
Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...
CVE-2026-83846: Use After Free
Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...
CVE-2026-85910: Buffer Over-read
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally...
CVE-2026-83933: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally...
CVE-2026-83692: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-83738: Use After Free
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...
CVE-2026-69942: Buffer Over-read
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally...
CVE-2026-69959: Out-of-bounds Read
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally...
CVE-2026-100200: Use After Free
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally...
CVE-2026-100112: Out-of-bounds Write
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-89117: Improper Neutralization of Input During Web Page Generation
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...
CVE-2026-108490: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...
CVE-2026-70194: Improper Certificate Validation
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-83693: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network...
CVE-2026-83723: Use of Uninitialized Resource
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...
CVE-2026-85322: Use of Uninitialized Resource
Use of uninitialized resource in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...
CVE-2026-69850: Untrusted Pointer Dereference
Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally...
CVE-2026-70225: Access of Resource Using Incompatible Type
Access of resource using incompatible type 'type confusion' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...
CVE-2026-83514: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-83759: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
Improper control of generation of code 'code injection' in Windows Encrypting File System EFS allows an authorized attacker to execute code over a network...
CVE-2026-69953: Buffer Over-read
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-96948: Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver csc.sys allows an authorized attacker to disclose information locally...
CVE-2026-102603: Unverified Password Change
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
CVE-2026-89124: Incorrect Authorization
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...
CVE-2026-110109: Missing Authorization
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...
CVE-2026-85914: Use After Free
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-85914: Windows Embedded Mode Service Elevation of Privilege Vulnerability
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally...
CVE-2026-103555: Heap-based Buffer Overflow
Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-85358: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-108959: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...
CVE-2026-76976: Improper Neutralization of Input During Web Page Generation
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...
Microsoft Windows: CVE-2026-70286: Windows Graphics Component Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-95943: Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability
Double free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-83793: Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally...
CVE-2026-89122: URL Redirection to Untrusted Site
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allo...
Microsoft Windows: CVE-2026-85841: Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an authorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-70048: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Resilient File System ReFS allows an authorized attacker to elevate privileges locally...
CVE-2026-110206: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...
Microsoft Windows: CVE-2026-83677: Windows DHCP Client Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network...
CVE-2026-83677: Missing Release of Memory after Effective Lifetime
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-83573: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack...
CVE-2026-88110: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-83925: Use of Uninitialized Resource
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally...