|
4951
|
6.7 |
MEDIUM
Local
|
-
|
-
|
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to…
|
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
|
CVE-2026-4878
|
2026-04-25 11:16 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4952
|
8.8 |
HIGH
Network
|
flowiseai
|
flowise
|
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated us…
|
CWE-284
CWE-639
CWE-915
Improper Access Control
Authorization Bypass Through User-Controlled Key
Improperly Controlled Modification of Dynamically-Determined Object Attributes
|
CVE-2026-41277
|
2026-04-25 11:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4953
|
7.5 |
HIGH
Network
|
flowiseai
|
flowise
|
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the u…
|
CWE-319
Cleartext Transmission of Sensitive Information
|
CVE-2026-41275
|
2026-04-25 11:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4954
|
8.3 |
HIGH
Network
|
flowiseai
|
flowise
|
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Func…
|
CWE-284
CWE-918
Improper Access Control
Server-Side Request Forgery (SSRF)
|
CVE-2026-41270
|
2026-04-25 11:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4955
|
7.5 |
HIGH
Network
|
flowiseai
|
flowise
|
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorizat…
|
CWE-200
CWE-522
CWE-862
Information Exposure
Insufficiently Protected Credentials
Missing Authorization
|
CVE-2026-41266
|
2026-04-25 11:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4956
|
5.9 |
MEDIUM
Network
|
-
|
-
|
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKC…
|
CWE-307
CWE-1289
mproper Restriction of Excessive Authentication Attempts
Improper Validation of Unsafe Equivalence in Input
|
CVE-2026-41213
|
2026-04-25 11:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4957
|
7.5 |
HIGH
Network
|
p11-kit_project
redhat
|
p11-kit
hardened_images
enterprise_linux
|
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters se…
|
CWE-824
Access of Uninitialized Pointer
|
CVE-2026-2100
|
2026-04-25 11:16 |
2026-03-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4958
|
7.5 |
HIGH
Network
|
p11-kit_project
redhat
|
p11-kit
hardened_images
enterprise_linux
|
Se encontró una falla en p11-kit. Un atacante remoto podría explotar esta vulnerabilidad al llamar a la función C_DeriveKey en un token remoto con parámetros específicos del mecanismo de derivación I…
|
CWE-824
Access of Uninitialized Pointer
|
CVE-2026-2100
|
2026-04-25 11:16 |
2026-03-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4959
|
7.8 |
HIGH
Local
|
-
|
-
|
A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a si…
|
CWE-427
Uncontrolled Search Path Element
|
CVE-2025-14821
|
2026-04-25 09:16 |
2026-04-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4960
|
- |
-
|
-
|
-
|
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
|
-
|
CVE-2026-6175
|
2026-04-25 08:16 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4961
|
6.5 |
MEDIUM
Network
|
-
|
-
|
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function. This function is used internally
in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated)…
|
CWE-124
Buffer Underflow
|
CVE-2026-0966
|
2026-04-25 08:16 |
2026-03-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4962
|
6.5 |
MEDIUM
Network
|
-
|
-
|
La función API 'ssh_get_hexa()' es vulnerable cuando se proporciona una entrada de longitud 0 a esta función. Esta función se utiliza internamente en 'ssh_get_fingerprint_hash()' y 'ssh_print_hexa()'…
|
CWE-124
Buffer Underflow
|
CVE-2026-0966
|
2026-04-25 08:16 |
2026-03-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4963
|
3.7 |
LOW
Network
|
-
|
-
|
A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially cr…
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-0988
|
2026-04-25 06:16 |
2026-01-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4964
|
3.7 |
LOW
Network
|
-
|
-
|
Se encontró una vulnerabilidad en glib. La falta de validación de los parámetros offset y count en la función g_buffered_input_stream_peek() puede conducir a un desbordamiento de entero durante el cá…
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-0988
|
2026-04-25 06:16 |
2026-01-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4965
|
6.5 |
MEDIUM
Network
|
linuxfoundation
|
tekton_pipelines
|
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 1.0.0 to 1.10.0, the Tekton Pipelines git resolver in API mode sends the system-configured Git API toke…
|
CWE-201
NVD-CWE-noinfo
Insertion of Sensitive Information Into Sent Data
|
CVE-2026-40161
|
2026-04-25 05:55 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4966
|
7.5 |
HIGH
Network
|
signalk
|
signal_k_server
|
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within …
|
CWE-400
CWE-1333
Uncontrolled Resource Consumption
Inefficient Regular Expression Complexity
|
CVE-2026-39320
|
2026-04-25 05:51 |
2026-04-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4967
|
7.1 |
HIGH
Local
|
craigjbass
|
clearancekit
|
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Si…
|
CWE-863
Incorrect Authorization
|
CVE-2026-40599
|
2026-04-25 05:50 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4968
|
4.4 |
MEDIUM
Local
|
craigjbass
|
clearancekit
|
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.6, the opfilter Endpoint Security system extension (bundle ID uk.craigbass.clearancek…
|
CWE-693
Protection Mechanism Failure
|
CVE-2026-40604
|
2026-04-25 05:49 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4969
|
8.8 |
HIGH
Network
|
goshs
|
goshs
|
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to file…
|
CWE-22
Path Traversal
|
CVE-2026-40876
|
2026-04-25 05:38 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4970
|
5.5 |
MEDIUM
Local
|
hkuds
|
openharness
|
OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attac…
|
CWE-863
Incorrect Authorization
|
CVE-2026-40515
|
2026-04-25 05:34 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4971
|
6.3 |
MEDIUM
Local
|
hkuds
|
openharness
|
OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by man…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-40516
|
2026-04-25 05:32 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4972
|
7.5 |
HIGH
Network
|
firebirdsql
|
firebird
|
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher se…
|
CWE-200
NVD-CWE-noinfo
Information Exposure
|
CVE-2025-65104
|
2026-04-25 05:27 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4973
|
9.8 |
CRITICAL
Network
|
samsung
|
magicinfo_9_server
|
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
|
CWE-22
CWE-434
Path Traversal
Unrestricted Upload of File with Dangerous Type
|
CVE-2024-7399
|
2026-04-25 05:23 |
2024-08-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4974
|
9.8 |
CRITICAL
Network
|
samsung
|
magicinfo_9_server
|
La limitación inadecuada de un nombre de ruta a una vulnerabilidad de directorio restringido en la versión Samsung MagicINFO 9 Server anterior a la 21.1050 permite a los atacantes escribir archivos a…
|
CWE-22
CWE-434
Path Traversal
Unrestricted Upload of File with Dangerous Type
|
CVE-2024-7399
|
2026-04-25 05:23 |
2024-08-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4975
|
5.5 |
MEDIUM
Local
|
giskard
|
giskard
|
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() wit…
|
CWE-1333
Inefficient Regular Expression Complexity
|
CVE-2026-40319
|
2026-04-25 05:22 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4976
|
6.7 |
MEDIUM
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_server_2016
windows_server_2019
windows_server_2022
|
Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.
|
CWE-807
Reliance on Untrusted Inputs in a Security Decision
|
CVE-2026-0390
|
2026-04-25 05:17 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4977
|
5.3 |
MEDIUM
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the applicati…
|
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
|
CVE-2026-41459
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4978
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an i…
|
CWE-184
Incomplete Blacklist
|
CVE-2026-34415
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4979
|
7.1 |
HIGH
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in re…
|
CWE-22
Path Traversal
|
CVE-2026-34414
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4980
|
8.6 |
HIGH
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unaut…
|
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
|
CVE-2026-34413
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4981
|
5.4 |
MEDIUM
Network
|
-
|
-
|
Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Buttoner for Elem…
|
CWE-862
Missing Authorization
|
CVE-2025-68085
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4982
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows Stored XSS.This issue affects Salient Sh…
|
CWE-79
Cross-site Scripting
|
CVE-2025-68079
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4983
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issu…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2025-68071
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4984
|
7.5 |
HIGH
Network
|
-
|
-
|
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects…
|
CWE-98
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
|
CVE-2025-68066
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4985
|
8.5 |
HIGH
Network
|
-
|
-
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from …
|
CWE-89
SQL Injection
|
CVE-2025-68055
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4986
|
5.5 |
MEDIUM
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2019
windows_server_2022
windows_server_2022_…
|
Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.
|
CWE-843
Type Confusion
|
CVE-2026-20806
|
2026-04-25 05:16 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4987
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a …
|
CWE-862
Missing Authorization
|
CVE-2025-54005
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4988
|
7.8 |
HIGH
Local
|
giskard
|
giskard
|
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silentl…
|
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
|
CVE-2026-40320
|
2026-04-25 05:15 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4989
|
4.6 |
MEDIUM
Physics
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.
|
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
|
CVE-2026-20928
|
2026-04-25 05:11 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4990
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_server_2019
windows_server_2022
windows_server_2022_23h2
windows_ser…
|
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
|
CWE-362
Race Condition
|
CVE-2026-20930
|
2026-04-25 05:10 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4991
|
5.7 |
MEDIUM
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
|
CWE-822
Untrusted Pointer Dereference
|
CVE-2026-23670
|
2026-04-25 05:09 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4992
|
7.0 |
HIGH
Local
|
microsoft
|
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2022_23h2
windows_server_2025
|
Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.
|
CWE-362
Race Condition
|
CVE-2026-25184
|
2026-04-25 05:08 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4993
|
7.1 |
HIGH
Network
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
|
CWE-357
Insufficient UI Warning of Dangerous Operations
|
CVE-2026-26151
|
2026-04-25 05:06 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4994
|
7.0 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.
|
CWE-922
Insecure Storage of Sensitive Information
|
CVE-2026-26152
|
2026-04-25 05:05 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4995
|
8.2 |
HIGH
Network
|
firebirdsql
|
firebird
|
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes s…
|
CWE-119
CWE-787
Incorrect Access of Indexable Resource ('Range Error')
Out-of-bounds Write
|
CVE-2026-27890
|
2026-04-25 05:05 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4996
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2019
windows_server_2022
windows_server_2022_…
|
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
|
CWE-125
Out-of-bounds Read
|
CVE-2026-26153
|
2026-04-25 05:03 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4997
|
7.5 |
HIGH
Network
|
microsoft
|
windows_server_2012
windows_server_2016
windows_server_2019
windows_server_2022
windows_server_2022_23h2
windows_server_2025
|
Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
|
CWE-20
Improper Input Validation
|
CVE-2026-26154
|
2026-04-25 05:02 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4998
|
6.5 |
MEDIUM
Network
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
|
CWE-126
Buffer Over-read
|
CVE-2026-26155
|
2026-04-25 05:02 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4999
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.
|
CWE-20
CWE-122
CWE-125
Improper Input Validation
Heap-based Buffer Overflow
Out-of-bounds Read
|
CVE-2026-26156
|
2026-04-25 05:00 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5000
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-26159
|
2026-04-25 04:54 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
