π¨ CVE-2025-35973
Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and require no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
π@cveNotify
Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and require no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
π@cveNotify
Intel
INTEL-SA-01428
π¨ CVE-2025-35987
Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (low) impacts.
π@cveNotify
Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (low) impacts.
π@cveNotify
Intel
INTEL-SA-01421
π¨ CVE-2026-20787
Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
π@cveNotify
Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
π@cveNotify
Intel
INTEL-SA-01422
π¨ CVE-2026-20795
Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
π@cveNotify
Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
π@cveNotify
Intel
INTEL-SA-01422
π¨ CVE-2026-50472
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
π@cveNotify
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
π@cveNotify
π¨ CVE-2026-16999
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.
This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
π@cveNotify
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.
This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
π@cveNotify
siberguvenlik.gov.tr
T.C. Siber GΓΌvenlik BaΕkanlΔ±ΔΔ±
TΓΌrkiye Cumhuriyeti CumhurbaΕkanlΔ±ΔΔ± Siber GΓΌvenlik BaΕkanlΔ±ΔΔ± resmi web sitesi.
π¨ CVE-2026-66375
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
π@cveNotify
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-66381
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
π@cveNotify
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-66382
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
π@cveNotify
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-67286
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.
π@cveNotify
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.
π@cveNotify
JoomShaper
SP Page Builder - The Best Joomla 6 Drag & Drop Page Builder
SP Page Builder is the best Joomla page builder to build modern and functional sites in minutes. Design your website visually with fully-functional addons.
π¨ CVE-2026-68760
An unauthenticated user may bypass authentication under specific cache conditions.
π@cveNotify
An unauthenticated user may bypass authentication under specific cache conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-15803
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.
π@cveNotify
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.
π@cveNotify
GitLab
request CVE for XXE in RDF4J before version 5.3.2 (#175) Β· Issues Β· Eclipse Projects Security / cve-assignment Β· GitLab
Project name: Eclipse RDF4J Project id: technology.rdf4j Versions affected: [, 5.3.2) Common Weakness Enumeration (CWE): CWE-611: Improper Restriction of XML...
π¨ CVE-2026-65926
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
π@cveNotify
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-66384
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
π@cveNotify
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-68758
A low-privileged authenticated user may access restricted support information under specific conditions.
π@cveNotify
A low-privileged authenticated user may access restricted support information under specific conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-68759
A holder of a valid integration credential may impersonate other users under specific conditions.
π@cveNotify
A holder of a valid integration credential may impersonate other users under specific conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-69107
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
π@cveNotify
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
π@cveNotify
Release Information
Artifactory Self-Hosted Releases
This section contains the Release Notes for Artifactory Self-Hosted releases.
π¨ CVE-2026-48550
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.
π@cveNotify
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.
π@cveNotify
π¨ CVE-2026-73237
XSS vulnerability in Markdown handling in Apache Allura.
This issue affects Apache Allura: from 1.10.0 before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
π@cveNotify
XSS vulnerability in Markdown handling in Apache Allura.
This issue affects Apache Allura: from 1.10.0 before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
π@cveNotify
π¨ CVE-2026-73238
XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
π@cveNotify
XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
π@cveNotify
π¨ CVE-2026-73239
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
π@cveNotify
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
π@cveNotify