Microsoft Windows: CVE-2026-70004: Remote Desktop Client Remote Code Execution Vulnerability

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-70012: Remote Desktop Client Remote Code Execution Vulnerability

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

CVE-2026-88219: Untrusted Pointer Dereference

Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-88219: RPC Runtime Library Remote Code Execution Vulnerability

Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-88193: Microsoft Scripting Engine Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88180: Windows DWM Core Library Elevation of Privilege Vulnerability

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88177: Windows DWM Core Library Elevation of Privilege Vulnerability

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...

CVE-2026-88174: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Deployment Services allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-88174: Windows Deployment Services Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Deployment Services allows an unauthorized attacker to execute code over a network...

CVE-2026-84020: Use After Free

Use after free in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70013: Windows iSCSI Remote Code Execution Vulnerability

Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-84019: Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-84018: Windows Print Spooler Components Elevation of Privilege Vulnerability

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-84016: Windows EAPHost Service Elevation of Privilege Vulnerability

Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally...

CVE-2026-84019: Use After Free

Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-84014: Windows Device Association Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-84013: Windows Telephony Server Elevation of Privilege Vulnerability

Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally...

CVE-2026-84012: Double Free

Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-84011: Windows SMB Client Security Feature Bypass Vulnerability

Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally...

CVE-2026-77096: Missing Authentication for Critical Function

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77816: Improper Certificate Validation

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information...

CVE-2026-7767: URL Redirection to Untrusted Site

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to...

CVE-2026-77362: Exposure of Sensitive Information to an Unauthorized Actor

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-77099: Improper Neutralization of Special Elements used in an OS Command

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-75826: Improper Neutralization of Special Elements used in an OS Command

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

CVE-2026-110256: Improper Neutralization of Special Elements used in an LDAP Query

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such...

CVE-2026-110240: Server-Side Request Forgery (SSRF)

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...

CVE-2026-110235: Improper Limitation of a Pathname to a Restricted Directory

MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting fil...

CVE-2026-110231: Improper Limitation of a Pathname to a Restricted Directory

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorizedkeys that, when...

CVE-2026-110225: Server-Side Request Forgery (SSRF)

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...

CVE-2026-110219: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

CVE-2026-110215: Missing Authorization

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/roleId/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role,...

CVE-2026-110214: Use of Hard-coded Cryptographic Key

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-110209: Missing Authorization

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config...

CVE-2026-78556: Improper Certificate Validation

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication Man-in-the-Middle attack and to spoof a...

CVE-2026-78632: Incorrect Permission Assignment for Critical Resource

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES...

CVE-2026-109961: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additionalmembers parameter of the Ftps.add API. Attackers can embed newline characters that the...

CVE-2026-109949: Improper Restriction of Excessive Authentication Attempts

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset...

CVE-2026-109944: Reachable Assertion

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

CVE-2026-109152: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function recvfile/recvpushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficie...

CVE-2026-109144: Uncontrolled Resource Consumption

A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-109697: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4...

CVE-2026-109691: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1...

CVE-2026-109114: Improper Authentication

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

CVE-2026-108493: Missing Authorization

Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1...

CVE-2026-108947: Deserialization of Untrusted Data

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...

CVE-2026-109606: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::saveuser of the file admin/adminclass.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote...

CVE-2026-102982: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

CVE-2026-109521: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be...

CVE-2026-109939: NULL Pointer Dereference

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...