CVEs published July 14, 2026

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was…

A vulnerability has been identified in Opcenter X (All versions < V2604).

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.

A security issue exists within the 1715-AENTR EtherNet/IP Adapter.

Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user.

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification,…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers…

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed…

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products.

There are hidden system accounts used for internal software operations.

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and…

Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are…

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.

6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while…

The Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun…

Template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can…

Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and…

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.

An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910.

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and…

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user.

Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the…

Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated…

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated…

Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over…

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with…

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication.

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims.

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

When Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel…

The decompress package for Node.js extracts archives.

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go

The sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be…

ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling…

Deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as…

Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user.

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user.

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user.

JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition…

7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a…

6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing…

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation.

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API.

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization.

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and…

A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code…

Deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code…

Rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include…

Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network.

Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.

Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.

Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges over a network.

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.

Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network.

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network.

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.

Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

A user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

_self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity:…

A vulnerability has been found in Tenda BE12 Pro 16.03.66.23.

A flaw has been found in Tenda BE12 Pro 16.03.66.23.

A vulnerability was detected in Tenda BE12 Pro 16.03.66.23.

A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23.

A weakness has been identified in Tenda BE12 Pro 16.03.66.23.

A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23.

A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1.

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter.

A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication.

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets.

A denial-of-service security issue exists in the 1719-AENTR.

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server…

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API.

A denial-of-service security issue exists in the affected products.

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs…

6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to…

Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.

Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.

6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with…

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network.

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability.

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another…

A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project.

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data.

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system.

Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.

Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium…

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.…

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially…

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through…

A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling.

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries.

Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before…

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying…

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

The per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later…

Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current…

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.

DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned.

Method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped,…

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs.

subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri,…

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a…

Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network.

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.

Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields.

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

{% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that…

Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling…

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be…

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a…

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write…

Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adjacent network.

Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.

Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

Use after free in DNS Server allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user.

Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

Use after free in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to elevate privileges locally.

Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.

Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally.

Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.

Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Use after free in Windows Media allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Windows allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Use after free in Windows Media allows an authorized attacker to elevate privileges locally.

Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows App Installer allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Key Guard allows an authorized attacker to elevate privileges locally.

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally.

Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.

Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.

Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.

Use after free in Windows Unified Consent System allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Integer underflow (wrap or wraparound) in Windows NTFS allows an unauthorized attacker to execute code locally.

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Use after free in Windows Internal Task Bar allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user.

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user.

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Premiere Pro is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization.

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer.

NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow.

NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index.

On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the…

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger…

SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host,…

Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.

Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current…

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers.

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure…

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration.

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file.

A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by…

DBI::ProfileData versions before 1.651 for Perl do not limit the path index.

The univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation.

The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes…

The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an…

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack…

A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information…

Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode.

Src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher…

PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF…

Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite().

Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network.

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.

Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

With -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping…

Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network.

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function

Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.

Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Use after free in Windows Message Queuing allows an authorized attacker to execute code over a network.

Use after free in Windows Netlogon allows an authorized attacker to elevate privileges over a network.

Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.

Untrusted pointer dereference in Windows Domain Controller allows an unauthorized attacker to deny service over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network.

Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an…

Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

The CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py,…

The CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or…

Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.

Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

The column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template…

LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and…

6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request…

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.

CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information.

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each…

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption.

NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

The JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing…

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to…

6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory.

6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence()…

6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file://…

6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be…

Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted…

Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML…

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a…

A vulnerability was found in libsoup's WebSocket frame parsing implementation.

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension.

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH…

The WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265…

DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects.

Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events.

Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user.

A first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.

A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions).

Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.

CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user.

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition.

Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component.

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component.

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component.

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence…

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI…

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84.

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0.

A weakness has been identified in code-projects Online Job Portal 1.0.

A security flaw has been discovered in code-projects Online Job Portal up to 1.0.

A vulnerability was identified in code-projects Online Job Portal 1.0.

A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary…

Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.

There is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message.

Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the…

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could…

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API.

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.

Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.

Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network.

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct…

The userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an…

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged…

Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Use after free in Windows WebView allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

A malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly…

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Service allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.

Use after free in Windows Media allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.

Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.

The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data":…

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions.

Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack.

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code with a physical attack.

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.

Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.

Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.

Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read.

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side request forgery.

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials.

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM…

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP…

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network.

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.

Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

Several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel.

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks and allowing an attacker with write access to…

Twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU…

The Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion.

6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from…

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial…

Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security…

Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security…

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem.

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts,…

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`.

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files…

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5.

The password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.

Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data…

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote…

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function.

NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization.

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's…

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to…

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack.

Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.

Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.

Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack.

The constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n` bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`.

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation.

A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device.

A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0.

A security vulnerability has been detected in tamagui up to 2.3.0.

A vulnerability was identified in spencermountain compromise up to 14.15.1.

A vulnerability was determined in kofrasa mingo up to 7.2.1.

A vulnerability was found in svgdotjs svg.js up to 3.2.5.

A vulnerability was determined in itsourcecode Electronic Judging System 1.0.

A vulnerability has been found in louisho5 picobot up to 0.2.0.

A weakness has been identified in louisho5 picobot up to 0.2.0.

A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1.

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3.

A vulnerability was found in nextlevelbuilder GoClaw 3.11.3.

A vulnerability has been found in nextlevelbuilder GoClaw 3.13.3-beta.3.

A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10.

A weakness has been identified in mosaxiv clawlet up to 0.2.10.

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10.

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured.

A denial-of-service security issue exists in 1734 POINT I/O™ module.

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service.

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread.

NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack.

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling.

Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious…

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to…

DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because…

DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps,…

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs…

7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed…

7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing…

Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass.

7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave…

7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL…

6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives match as unanchored…

7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link…

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist.

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2…

Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

An attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.

Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.

A vulnerability was found in libsoup's HTTP/2 protocol implementation.

A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework.

The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to…

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the…

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all…

Out-of-bounds read in Windows Kernel allows an authorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally.

Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Notification allows an authorized attacker to disclose information locally.

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally.

Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.

Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally.

Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read.

Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.

Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.

Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration…

The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then…

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands.

Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a…

Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a…

Several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other…

The deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input.

7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored…

A vulnerability was determined in zhinianboke xianyu-auto-reply on Server.

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

An HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty…

For HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).

Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in…

Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse…

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny service over a network.

Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized attacker to disclose information over a network.

The optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the…

MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of…

A regular expression denial-of-service vulnerability exists when using the Client Hints API.

Denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas.

7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio…

MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open,…

7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged…

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data.

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive…

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0.

A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0.

A vulnerability was found in louisho5 picobot up to 0.2.0.

A flaw has been found in poco-ai poco-claw up to 0.5.4.

A vulnerability was detected in mosaxiv clawlet up to 0.2.10.

Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling.

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6.

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute arbitrary commands as root by…

Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint.

Rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite…

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and…

Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields.

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected.

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router.

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS).

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows Devices Human Interface allows an authorized attacker to disclose information locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which…

A security flaw has been discovered in DedeCMS 5.7.118.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the…

A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings

An infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

The TNEF decoder was subject to denial of service via a crafted compressed-RTF size.

Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin.

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through…

The column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an…

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges.

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information.

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3.

The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest.

Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive…

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information.

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email…

Jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML…

A security vulnerability has been detected in code-projects Online Job Portal 1.0.

Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary.

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response…

`Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking…

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for…

A vulnerability was identified in open62541 up to 1.5.5.

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the…

`Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation.

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass.

Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page.