CVE-2026-68xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
671 records · Page 2 of 7
Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
UpdatedInteger underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network.
UpdatedUse after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-68824: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability 7.0 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
Updated Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
UpdatedImproper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.
UpdatedStack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedStack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedIncomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedNumeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUse of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedStack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.
UpdatedIncorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
UpdatedHeap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
UpdatedOut-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedUse of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
UpdatedZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands wh
Updated- CVE-2026-68771: ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization 9.3 Critical
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt ref
Updated - CVE-2026-68770: sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False 9.3 Critical
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local files
Updated This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected record- CVE-2026-68768: hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username 6.9 Medium
hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show again
Updated hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.
Updated- CVE-2026-68766: hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection 8.5 High
hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.
Updated hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal in
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordUncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. O
UpdatedIn JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
UpdatedAn unauthenticated user may bypass authentication under specific cache conditions.
UpdatedA holder of a valid integration credential may impersonate other users under specific conditions.
Updated- CVE-2026-68758: Authenticated users may access restricted Artifactory support information 6.5 Medium
A low-privileged authenticated user may access restricted support information under specific conditions.
Updated A user with access to a valid SAML response may impersonate another user under specific conditions.
UpdatedA party with write access to stored session data may affect JFrog Artifactory under specific conditions.
Updated- CVE-2026-68755: Bundle writers may alter trusted release information in JFrog Artifactory 4.3 Medium
A bundle writer may create misleading release promotion information under specific conditions.
Updated - CVE-2026-68754: Publishers without delete permission can overwrite docker layer information 6.5 Medium
A repository publisher without delete permission may modify protected package content under specific conditions.
Updated An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
UpdatedA Project Resource Manager may gain broader administrative privileges under specific conditions.
UpdatedInefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened re
UpdatedInefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not foll
Updated- CVE-2026-68747: CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input 2.3 Low
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.re
Updated Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to, and resolves that identifier against a locally cached list of deploymen
Updated- CVE-2026-68745: Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP 8.1 High
Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures. Users are recommended t
Updated A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
UpdatedA flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Updated- CVE-2026-68742: Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr 5.5 Medium
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Updated SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be re
UpdatedSiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is
UpdatedSiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID to retrieve the title, notebook, path, root ID, and icon of documents administrators marked as exclude
UpdatedSiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible
Updatedluci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.
UpdatedVikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the vie
Updated- CVE-2026-68581: Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision 8.6 High
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's num
Updated FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all pl
UpdatedFreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the serv
UpdatedArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
UpdatedReserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Updated · Rejected recordReserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Updated · Rejected recordReserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Updated · Rejected recordReserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Updated · Rejected recordImproper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue
UpdatedExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
UpdatedImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to v
UpdatedIncorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Users are recommended to upgrade to a fixed
UpdatedImproper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was
Updated- CVE-2026-68568: WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability 6.3 Medium
Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
Updated- CVE-2026-68566: WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
Updated - CVE-2026-68565: WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
Updated