CVE-2026-70xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
844 records · Page 6 of 9
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization
UpdatedDell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to root, impacting confidentiality, integrity, and availability.
UpdatedDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
UpdatedDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
UpdatedDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
UpdatedDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
UpdatedDell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
UpdatedDell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
UpdatedDell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service.
UpdatedDell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
UpdatedDell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
UpdatedDell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
UpdatedDell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage acc
Updated- CVE-2026-70410: Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins 8.8 High
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Class.forName(String) which by default triggers initialization. This may lead to the execution of static initializer blocks in arbitrary classes
Updated - CVE-2026-70409: eldap does not bound the port component of a referral URL before integer conversion 6.3 Medium
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to par
Updated An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.
UpdatedGitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.
UpdatedGitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token's public-only restriction; it does not re
Updated- CVE-2026-70405: snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields 6.3 Medium
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift an
Updated XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
UpdatedGitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
UpdatedGitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same toke
UpdatedAllocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does n
UpdatedA flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to
UpdatedGitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary whi
UpdatedImproper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the
UpdatedSOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially a
UpdatedExposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribu
UpdatedImproper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlu
UpdatedImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0.
UpdatedSome externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
UpdatedAn access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or a
UpdatedA denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists. Miracast P2P is not affected. MICE is disabled i
UpdatedWhen the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolut
Updatedimagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.
Updatedimagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.
Updated- CVE-2026-70376: Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE 9.6 Critical
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
Updated HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.
UpdatedHashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).
UpdatedKoha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column iden
UpdatedKoha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sess
UpdatedKoha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and com
UpdatedKoha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
UpdatedKoha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.
UpdatedA stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be u
UpdatedA Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reac
UpdatedGitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; v
Updated- CVE-2026-70356: Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type 9.4 Critical
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Updated Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
UpdatedOut-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
UpdatedMissing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
UpdatedInteger overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network.
UpdatedImproper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.
UpdatedHeap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedStack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedStack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-70342: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 8.1 High
Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network.
Updated Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
UpdatedMissing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
UpdatedImproper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
UpdatedRelative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
UpdatedImproper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
UpdatedImproper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
UpdatedIncomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
UpdatedImproper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
UpdatedHeap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedInteger overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
UpdatedImproper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
UpdatedImproper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedImproper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedUse of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedImproper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
UpdatedOrigin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Updated- CVE-2026-70307: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
UpdatedHeap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedUntrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedImproper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
UpdatedImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Updated