CVE-2026-68874 - Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker

CVE-2026-68873 - Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service

CVE-2026-68852 - Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose informa

CVE-2026-68851 - Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

CVE-2026-68850 - Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges

CVE-2026-68849 - Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose inform

CVE-2026-68848 - Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elev

CVE-2026-68847 - Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to

CVE-2026-68846 - Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network.

CVE-2026-68845 - Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized a

CVE-2026-68844 - Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to exe

CVE-2026-68843 - Use after free in Microsoft Office Word allows an authorized attacker to disclose information locall

CVE-2026-68842 - Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service M

CVE-2026-68841 - Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges local

CVE-2026-68840 - Concurrent execution using shared resource with improper synchronization ('race condition') in Windo

CVE-2026-68839 - Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker

CVE-2026-68838 - Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over

CVE-2026-68837 - Use after free in Windows File History Service allows an authorized attacker to elevate privileges l

CVE-2026-68835 - Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileg

CVE-2026-68834 - Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over

CVE-2026-68833 - Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a ph

CVE-2026-68832 - Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges l

CVE-2026-68831 - Files or directories accessible to external parties in Windows Defender Firewall Service allows an a

CVE-2026-68830 - Improper link resolution before file access ('link following') in Windows Universal Plug and Play (U

CVE-2026-68828 - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code

CVE-2026-68827 - Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate priv

CVE-2026-68825 - Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges loc

CVE-2026-68824 - Concurrent execution using shared resource with improper synchronization ('race condition') in Windo

CVE-2026-68787 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.

CVE-2026-68786 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-68785 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-68784 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-68781 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-68780 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-68779 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-68778 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-68777 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-68776 - Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov

CVE-2026-68775 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67648 - Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov

CVE-2026-67645 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-67643 - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a netw

CVE-2026-67642 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67641 - Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a ne

CVE-2026-67639 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67638 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67636 - Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.

CVE-2026-67633 - Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.

CVE-2026-67631 - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a netw

CVE-2026-67630 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-67629 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-67624 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-67393 - Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

CVE-2026-67390 - Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

CVE-2026-67389 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-67388 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67386 - Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov

CVE-2026-67385 - Use after free in SQL Server allows an authorized attacker to execute code over a network.

CVE-2026-67384 - Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a ne

CVE-2026-67383 - Generation of error message containing sensitive information in SQL Server allows an authorized atta

CVE-2026-67381 - Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a

CVE-2026-67380 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67379 - Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a netwo

CVE-2026-67378 - Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a n

CVE-2026-67376 - Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a

CVE-2026-67373 - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ

CVE-2026-67370 - Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a

CVE-2026-67369 - Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ

CVE-2026-67368 - Improper link resolution before file access ('link following') in SQL Server allows an authorized at

CVE-2026-66820 - Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a

CVE-2026-66819 - Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a

CVE-2026-66818 - Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over

CVE-2026-66816 - Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a

CVE-2026-66814 - Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate pr

CVE-2026-65812 - Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorize

CVE-2026-65772 - Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute

CVE-2026-65669 - Improper neutralization of special elements in output used by a downstream component ('injection') i

CVE-2026-64918 - Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform

CVE-2026-62895 - Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker t

CVE-2026-62813 - Use after free in Active Directory Domain Services allows an authorized attacker to execute code ove

CVE-2026-62810 - Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized att

CVE-2026-62804 - External control of file name or path in Microsoft Office Word allows an unauthorized attacker to ex

CVE-2026-62801 - Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell

CVE-2026-62762 - Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s

CVE-2026-62759 - Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spo

CVE-2026-62744 - Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to

CVE-2026-62706 - Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute

CVE-2026-62697 - Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges loc

CVE-2026-62694 - Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-58649 - Origin validation error in .NET allows an unauthorized attacker to disclose information over a netwo

CVE-2026-58611 - Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges l

CVE-2026-58600 - Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to el

CVE-2026-58599 - Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to ex

CVE-2026-57099 - Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker

CVE-2026-57098 - Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attack

CVE-2026-56198 - Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privilege

CVE-2026-56177 - Use after free in Windows Server allows an authorized attacker to elevate privileges locally.

CVE-2026-56172 - Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges lo

CVE-2026-55007 - Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a netw

CVE-2026-54611 - InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remo

CVE-2026-50349 - Concurrent execution using shared resource with improper synchronization ('race condition') in Windo

CVE-2026-48707 - InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Serv

CVE-2026-47297 - Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over

CVE-2026-86668 - A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted eleme

CVE-2026-86667 - A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the fu

CVE-2026-86073 - n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endp

CVE-2026-84393 - A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 thro

CVE-2026-84392 - A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all version

CVE-2026-84391 - A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allo

CVE-2026-84389 - A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 thro

CVE-2026-84387 - A improper neutralization of special elements used in a command ('command injection') vulnerability

CVE-2026-84386 - A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClient

CVE-2026-84385 - A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR Pa

CVE-2026-82533 - DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants un

CVE-2026-82514 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-82076 - An integer overflow in the query planning component of MongoDB Server can allow an authenticated use

CVE-2026-82075 - An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sha

CVE-2026-82074 - MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An au

CVE-2026-82073 - A security issue in the MongoDB Server aggregation framework allows an authenticated user with limit

CVE-2026-82071 - Insufficient validation of storage engine configuration options in MongoDB Server allows an authenti

CVE-2026-82070 - A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user wit

CVE-2026-82069 - A security issue in MongoDB Server's query statistics serialization on the router allows users with

CVE-2026-82068 - A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a p

CVE-2026-82067 - Improper handling of case sensitivity in the configuration validation component of MongoDB Server ma

CVE-2026-82066 - A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. A

CVE-2026-82065 - A security issue in the MongoDB Server's storage engine integration layer allows an authenticated us

CVE-2026-82064 - A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of servi

CVE-2026-82063 - A use-after-free security issue in the cursor management component of MongoDB Server allows an authe

CVE-2026-82062 - A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to

CVE-2026-82061 - A use-after-free security issue exists in the server's query execution memory tracking subsystem. An

CVE-2026-82060 - In MongoDB, insufficient validation of shard key values during document insertion allowed authentica

CVE-2026-82059 - An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any

CVE-2026-82058 - A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with r

CVE-2026-82057 - A security issue was discovered in MongoDB where an authenticated user with readWrite privileges cou

CVE-2026-82056 - A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read w

CVE-2026-82055 - A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due

CVE-2026-82054 - A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter

CVE-2026-82053 - A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections ca

CVE-2026-82052 - The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline s

CVE-2026-81531 - An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint in

CVE-2026-79570 - mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName par

CVE-2026-79569 - Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter

CVE-2026-78997 - UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-S

CVE-2026-78230 - AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate resu

CVE-2026-78216 - AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an op

CVE-2026-75156 - Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of A

CVE-2026-52307 - An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component

CVE-2026-47625 - NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse miss

CVE-2026-26084 - A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4

CVE-2026-22575 - An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager

CVE-2026-20293 - A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UC

CVE-2026-16497 - NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause exce

CVE-2026-86853 - A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or externa

CVE-2026-86840 - The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability i

CVE-2026-86738 - Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to

CVE-2026-86737 - snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}

CVE-2026-86736 - snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling t

CVE-2026-86735 - snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUr

CVE-2026-86734 - Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{ac

CVE-2026-86733 - Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/

CVE-2026-86732 - Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index

CVE-2026-86731 - Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::a

CVE-2026-86730 - Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allow

CVE-2026-86729 - WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in

CVE-2026-86728 - AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php

CVE-2026-86727 - AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php t

CVE-2026-86726 - AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php tha

CVE-2026-86725 - AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerabili

CVE-2026-86724 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery

CVE-2026-86723 - AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerabil

CVE-2026-86722 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vul

CVE-2026-86721 - AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cook

CVE-2026-86720 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of l

CVE-2026-86719 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site r

CVE-2026-86718 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo

CVE-2026-86666 - A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function

CVE-2026-86600 - In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity t

CVE-2026-79574 - An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sendin

CVE-2026-79573 - L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/get

CVE-2026-79572 - An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.

CVE-2026-56101 - OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael

CVE-2026-16769 - An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/S

CVE-2026-16037 - Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. P

CVE-2026-16025 - Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Mon

CVE-2026-9040 - A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driv

CVE-2026-9034 - Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace

CVE-2026-86665 - A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the functio

CVE-2026-86135 - A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creati

CVE-2026-84282 - A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plu

CVE-2026-83527 - An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote

CVE-2026-7477 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-7476 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-79577 - An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the

CVE-2026-79576 - An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to

CVE-2026-79575 - The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instea

CVE-2026-79571 - Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows

CVE-2026-78837 - A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attacker

CVE-2026-70614 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-70613 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-61517 - Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the

CVE-2026-61516 - Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that

CVE-2026-5729 - Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architect

CVE-2026-33197 - AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List o

CVE-2026-18851 - Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8

CVE-2026-12745 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12744 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12651 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12650 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12648 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12647 - A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe

CVE-2026-12646 - A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe

CVE-2026-12645 - A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe

CVE-2026-12387 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-12285 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-11891 - Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Archit

CVE-2026-0860 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kern

CVE-2026-0001 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-86644 - A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown co

CVE-2026-79379 - A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio

CVE-2026-79378 - An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmwar

CVE-2026-79377 - A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio

CVE-2026-79376 - An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firm

CVE-2026-78838 - A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitr

CVE-2026-74239 - XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windo

CVE-2026-73321 - XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that all

CVE-2026-73320 - XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows u

CVE-2026-73319 - XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler

CVE-2026-73318 - XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controll

CVE-2026-73317 - XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispat

CVE-2026-73316 - XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider th

CVE-2026-73315 - XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhoo

CVE-2026-73314 - XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handl

CVE-2026-73313 - XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA

CVE-2026-73312 - XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a

CVE-2026-73311 - XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attacker

CVE-2026-73310 - XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attack

CVE-2026-73309 - XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint t

CVE-2026-33920 - A cross-site request forgery vulnerability was discovered in the login functionality (both standard

CVE-2026-33391 - An access control vulnerability was discovered in the Smart Polling configuration functionality due

CVE-2026-33389 - An improper certificate/host key validation vulnerability was discovered in the Smart Polling functi

CVE-2026-33388 - An access control vulnerability was discovered in the Credentials Manager functionality due to insuf

CVE-2026-33387 - A template injection vulnerability was discovered in the Dashboards functionality due to improper va

CVE-2026-79603 - x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB f

CVE-2026-79602 - A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG()

CVE-2026-77106 - Cvlaunchd contained a missing authorization issue affecting command execution authorization. Softwar

CVE-2026-77105 - CommServe contained a cryptographic signature verification issue affecting privilege management. Sof

CVE-2026-77104 - CommServe contained a path traversal issue affecting information disclosure. Software customers upgr

CVE-2026-77103 - CommServe contained an authentication bypass issue affecting access authorization and information di

CVE-2026-77102 - CommServe contained a heap-based buffer overflow issue affecting service availability. Software cust

CVE-2026-77101 - CommServe contained a stack-based buffer overflow issue affecting service availability. Software cus