🚨 CVE-2026-26084
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
🎖@cveNotify
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
🎖@cveNotify
🚨 CVE-2026-78216
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_lua: from 0.1.0 before 0.2.2.
🎖@cveNotify
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_lua: from 0.1.0 before 0.2.2.
🎖@cveNotify
🚨 CVE-2026-78230
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
🎖@cveNotify
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
🎖@cveNotify
🚨 CVE-2026-47297
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-48707
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
🎖@cveNotify
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
🎖@cveNotify
GitHub
Fix SSRF redirect/DNS rebinding · instantsoft/icms2@04b8fe0
Self-hosted Site Management System. Contribute to instantsoft/icms2 development by creating an account on GitHub.
🚨 CVE-2026-50349
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-54611
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
🎖@cveNotify
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
🎖@cveNotify
GitHub
Установка дополнений через временную директорию; отсутствует возможно… · instantsoft/icms2@44f3a9d
…сть доступа к распакованным файлам по URL; защита от Zip Slip; проверка и запрет символических ссылок (symlink) в ZIP-архивах; защита от Zip Bomb (лимит количества файлов, размера архива и размера...
🚨 CVE-2026-55007
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-56172
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-56177
Use after free in Windows Server allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Server allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-56198
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-57098
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-57099
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-58599
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
🎖@cveNotify
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
🎖@cveNotify
🚨 CVE-2026-58600
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-58611
Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-58649
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-62694
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-62697
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-62706
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-62759
Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.
🎖@cveNotify
Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.
🎖@cveNotify