🚨 CVE-2026-59912
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution.
🎖@cveNotify
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution.
🎖@cveNotify
🚨 CVE-2026-59913
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
🎖@cveNotify
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
🎖@cveNotify
🚨 CVE-2026-62354
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.
🎖@cveNotify
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.
🎖@cveNotify
🚨 CVE-2026-68979
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
🎖@cveNotify
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
🎖@cveNotify
🚨 CVE-2026-18667
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
🎖@cveNotify
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
🎖@cveNotify
Tenable®
[R1] Sensor Proxy Version 1.4.2 Fixes One Vulnerability
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
🚨 CVE-2026-62870
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66310
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
🎖@cveNotify
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-66312
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
🎖@cveNotify
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66315
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66318
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-66321
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66326
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
🎖@cveNotify
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
🎖@cveNotify
Zyxel
Zyxel security advisory for command injection and improper authentication vulnerabilities in certain APs, FWA7, and Security Routers…
CVEs: CVE-2026-6837, CVE-2026-8508 Summary Zyxel has released patches for specific firmware versions of its APs, FWA7, and Security Routers. These updates address command injection and improper authentication vulnerabilities. Users are strongly advised to…
🚨 CVE-2026-18739
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
Redhat
CVE-2026-18739 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-10710
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
🎖@cveNotify
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
🎖@cveNotify
Autodesk
Autodesk Access | Formerly Autodesk Desktop App | Autodesk
Autodesk Access simplifies the update experience. Quickly and easily install updates for your desktop products from the app. Download now for free.
🚨 CVE-2026-21366
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
🚨 CVE-2026-24076
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
🚨 CVE-2026-24079
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
🚨 CVE-2026-24080
Memory Corruption when handling malformed request parameters in the fingerprint TA.
🎖@cveNotify
Memory Corruption when handling malformed request parameters in the fingerprint TA.
🎖@cveNotify
🚨 CVE-2026-24083
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
🎖@cveNotify
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
🎖@cveNotify
🚨 CVE-2026-25289
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
🎖@cveNotify
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
🎖@cveNotify