🚨 CVE-2026-62870
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66310
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
🎖@cveNotify
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-66312
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
🎖@cveNotify
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66315
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66318
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-66321
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66326
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
🎖@cveNotify
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
🎖@cveNotify
Zyxel
Zyxel security advisory for command injection and improper authentication vulnerabilities in certain APs, FWA7, and Security Routers…
CVEs: CVE-2026-6837, CVE-2026-8508 Summary Zyxel has released patches for specific firmware versions of its APs, FWA7, and Security Routers. These updates address command injection and improper authentication vulnerabilities. Users are strongly advised to…
🚨 CVE-2026-18739
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
Redhat
CVE-2026-18739 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-10710
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
🎖@cveNotify
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
🎖@cveNotify
Autodesk
Autodesk Access | Formerly Autodesk Desktop App | Autodesk
Autodesk Access simplifies the update experience. Quickly and easily install updates for your desktop products from the app. Download now for free.
🚨 CVE-2026-21366
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
🚨 CVE-2026-24076
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
🚨 CVE-2026-24079
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
🚨 CVE-2026-24080
Memory Corruption when handling malformed request parameters in the fingerprint TA.
🎖@cveNotify
Memory Corruption when handling malformed request parameters in the fingerprint TA.
🎖@cveNotify
🚨 CVE-2026-24083
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
🎖@cveNotify
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
🎖@cveNotify
🚨 CVE-2026-25289
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
🎖@cveNotify
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
🎖@cveNotify
🚨 CVE-2026-15307
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.
🎖@cveNotify
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.
🎖@cveNotify
Django Project
Archive of security issues | Django documentation
The web framework for perfectionists with deadlines.
🚨 CVE-2026-58072
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.
🎖@cveNotify
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.
🎖@cveNotify
Veeam Software
KB4893: Vulnerabilities Resolved in Veeam Service Provider Console 9.3
Veeam has resolved four security vulnerabilities in Veeam Service Provider Console, two rated Critical and two rated High, all affecting version 9.2 and earlier. This article documents each CVE with its severity, CVSS v4.0 score, and the build in which it…
🚨 CVE-2026-58073
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
🎖@cveNotify
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
🎖@cveNotify
Veeam Software
KB4893: Vulnerabilities Resolved in Veeam Service Provider Console 9.3
Veeam has resolved four security vulnerabilities in Veeam Service Provider Console, two rated Critical and two rated High, all affecting version 9.2 and earlier. This article documents each CVE with its severity, CVSS v4.0 score, and the build in which it…
🚨 CVE-2026-58074
A vulnerability allowing a high-privileged user to execute arbitrary code on the server.
🎖@cveNotify
A vulnerability allowing a high-privileged user to execute arbitrary code on the server.
🎖@cveNotify
Veeam Software
KB4892: Vulnerabilities Resolved in Veeam ONE 13.1
🚨 CVE-2026-58075
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
🎖@cveNotify
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
🎖@cveNotify
Veeam Software
KB4892: Vulnerabilities Resolved in Veeam ONE 13.1