🚨 CVE-2026-48566
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-58643
Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.

🎖@cveNotify

🚨 CVE-2026-62241
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.

🎖@cveNotify

🚨 CVE-2026-63521
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-64910
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-65672
Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-65679
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

🎖@cveNotify

🚨 CVE-2026-65681
Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.

🎖@cveNotify

🚨 CVE-2026-65777
Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.

🎖@cveNotify

🚨 CVE-2026-65796
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

🎖@cveNotify

🚨 CVE-2026-66809
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-68792
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-70317
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-70323
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-53783
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

🎖@cveNotify

🚨 CVE-2026-53802
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

🎖@cveNotify

🚨 CVE-2026-73556
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.

🎖@cveNotify

🚨 CVE-2026-19710
A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

🎖@cveNotify

🚨 CVE-2026-73559
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.

🎖@cveNotify

🚨 CVE-2026-73670
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.

🎖@cveNotify

🚨 CVE-2026-73671
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.

🎖@cveNotify