CVE-2026-96xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
522 records · Page 5 of 6
Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.
UpdatedMissing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.
UpdatedOut-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally.
UpdatedMissing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedImproper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedImproperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.
UpdatedUse after free in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedUncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network.
UpdatedA security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute o
UpdatedUse of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelate
UpdatedUncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Updated- CVE-2026-96293: Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File 6.9 Medium
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.
Updated Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
UpdatedUncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
UpdatedUncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
UpdatedInefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Updated- CVE-2026-96286: Apache Thrift: Perl servers end `serve()` when serving one connection fails 8.2 High
Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Updated A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
UpdatedBy calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
UpdatedA malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
UpdatedOn a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vuln
Updated- CVE-2026-96280: Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems 7.5 High
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially ac
Updated - CVE-2026-96279: Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks 6.5 Medium
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.
Updated The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass wor
UpdatedUncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
UpdatedIf a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.
UpdatedA malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
UpdatedIn Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the
UpdatedGhidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.
UpdatedClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.
UpdatedPhotoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.
UpdatedThe Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i
UpdatedGNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
UpdatedThe Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will
UpdatedThe WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already exi
UpdatedIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it
UpdatedIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploit
UpdatedIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to
UpdatedIBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation cou
UpdatedIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to t
UpdatedIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availabilit
UpdatedMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775
UpdatedMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776
UpdatedA vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendo
Updated- CVE-2026-96257: Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow 10.0 Critical
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Updated The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly int
UpdatedThe Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedImproper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
UpdatedReliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
UpdatedStack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.
UpdatedUse of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
UpdatedUse after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
UpdatedImproper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
UpdatedOrigin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
UpdatedInclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
UpdatedAllocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
UpdatedOut-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
UpdatedOrigin validation error in .NET allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
UpdatedOut-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
UpdatedImproper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
UpdatedPermissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
UpdatedSSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was ch
UpdatedThe Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
UpdatedImproper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
UpdatedImproper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
UpdatedImproper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-96219: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability 9.8 Critical
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
Updated Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
UpdatedHeap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
UpdatedImproper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
UpdatedUse of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
UpdatedServer-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
Updated