🚨 CVE-2026-54117
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
🎖@cveNotify
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-54118
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
🎖@cveNotify
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-47295
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-54116
Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-55010
Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2025-24259
This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check.
🎖@cveNotify
This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check.
🎖@cveNotify
Apple Support
About the security content of macOS Sequoia 15.4 - Apple Support
This document describes the security content of macOS Sequoia 15.4.
🚨 CVE-2026-56170
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50468
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-56176
Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-58535
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-58536
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-58537
Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-47300
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-47303
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-50524
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50526
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
🎖@cveNotify
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
🎖@cveNotify
🚨 CVE-2026-50528
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
🎖@cveNotify
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
🎖@cveNotify
🚨 CVE-2026-50651
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-9734
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
🎖@cveNotify
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
🎖@cveNotify
🚨 CVE-2026-1372
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
🎖@cveNotify
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
🎖@cveNotify
🚨 CVE-2026-60080
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.
A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
🎖@cveNotify
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.
A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
🎖@cveNotify