412514 matches found
CVE-2026-109898: Missing Authorization
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25...
CVE-2026-85854: Use After Free
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...
CVE-2026-85857: Insertion of Sensitive Information into Log File
Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally...
CVE-2026-83747: Out-of-bounds Read
Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally...
CVE-2026-87695: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...
CVE-2026-104344: Heap-based Buffer Overflow
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-77205: Missing Release of Resource after Effective Lifetime
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...
CVE-2026-83749: Use After Free
Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...
CVE-2026-70273: Use After Free
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...
CVE-2026-83517: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network...
Microsoft SharePoint: CVE-2026-70202: Microsoft Office SharePoint Elevation of Privilege Vulnerability
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-69919: Out-of-bounds Read
Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
CVE-2026-89107: Improper Control of Generation of Code
SAP S/4HANA Manage Substitution/Validation Rules does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpret...
CVE-2026-106173: Improper Limitation of a Pathname to a Restricted Directory
A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...
CVE-2026-109890: Missing Authorization
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...
Gitlab Gitlab: CVE-2026-97229: Integer Overflow or Wraparound
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...
CVE-2026-97229: Integer Overflow or Wraparound
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...
CVE-2026-77206: NULL Pointer Dereference
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a...
CVE-2026-69931: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Storage allows an authorized attacker to elevate privileges locally...
CVE-2026-88179: Out-of-bounds Read
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...
CVE-2026-83721: Use After Free
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...
CVE-2026-109155: Improper Limitation of a Pathname to a Restricted Directory
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...
Microsoft Windows: CVE-2026-96316: Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability
Improper access control in Windows Routing and Remote Access Service RRAS allows an authorized attacker to perform tampering locally...
CVE-2026-77902: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
CVE-2026-96926: Missing Authorization
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-88072: Improper Link Resolution Before File Access
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...
CVE-2026-105010: Use After Free
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-96925: Integer Underflow (Wrap or Wraparound)
Integer underflow wrap or wraparound in Windows NTFS allows an authorized attacker to disclose information locally...
CVE-2026-96943: Integer Overflow or Wraparound
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...
CVE-2026-63152: Improper Neutralization of Special Elements used in an SQL Command
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...
CVE-2026-109964: Buffer Underwrite
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...
CVE-2026-70151: Use After Free
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally...
CVE-2026-96953: NULL Pointer Dereference
Null pointer dereference in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to execute code locally...
CVE-2026-96866: Out-of-bounds Read
Out-of-bounds read in Network Device Enrollment Service NDES allows an unauthorized attacker to deny service over a network...
CVE-2026-83756: Use After Free
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...
CVE-2026-96856: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally...
CVE-2026-74041: Improper Handling of Case Sensitivity
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on...
CVE-2026-85375: Use After Free
Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-96300: RPC Endpoint Mapper Service Denial of Service Vulnerability
Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network...
CVE-2026-63154: Improper Neutralization of Special Elements used in an SQL Command
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
CVE-2026-109725: Use After Free
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109724: Use After Free
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-107682: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-83758: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally...
CVE-2026-96096: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network...
CVE-2026-97009: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
Microsoft Windows: CVE-2026-83846: Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability
Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...
CVE-2026-97016: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...