🚨 CVE-2026-16607
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
🎖@cveNotify
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
🎖@cveNotify
global.fujitsu
Fujitsu BS2000 Software Integration
Die Produktsuite openSEAS unterstützt die Anwendungsintegration von BS2000-Applikationen hin zu modernen Kommunikationsmitteln. Somit ist der Anschluss ans Internet, Application Server und mobile Geräte möglich.
🚨 CVE-2026-16157
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write to. A standard local user can overwrite any DLL in the service directory. On service restart, the OS loads the attacker's DLL before any managed code runs, executing arbitrary code as SYSTEM.
🎖@cveNotify
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write to. A standard local user can overwrite any DLL in the service directory. On service restart, the OS loads the attacker's DLL before any managed code runs, executing arbitrary code as SYSTEM.
🎖@cveNotify
kb.cert.org
CERT/CC Vulnerability Note VU#847406
Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
🚨 CVE-2026-65650
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
🎖@cveNotify
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
🎖@cveNotify
GitHub
fix(images): prevent OOM issues when images are too large to resize · Elgg/Elgg@ab91d59
backported from Elgg 7.0
🚨 CVE-2026-10649
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
🎖@cveNotify
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
🎖@cveNotify
🚨 CVE-2026-50522
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-56170
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-57108
Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-47300
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-47302
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-47303
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-47304
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
🎖@cveNotify
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
🎖@cveNotify
🚨 CVE-2026-50524
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50525
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50526
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
🎖@cveNotify
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
🎖@cveNotify
🚨 CVE-2026-50527
Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50528
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
🎖@cveNotify
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
🎖@cveNotify
🚨 CVE-2026-50648
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50651
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50659
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
🎖@cveNotify
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
🎖@cveNotify
🚨 CVE-2026-16232
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
🎖@cveNotify
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
🎖@cveNotify
Checkpoint
sk185169 - CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token
Applies to: Multi-Domain Security Management, Security Management
🚨 CVE-2025-44089
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
🎖@cveNotify
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
🎖@cveNotify
GitHub
Public-references/CVE-2025-44089.md at main · OV-0-VO/Public-references
References required for CVE publication. Contribute to OV-0-VO/Public-references development by creating an account on GitHub.