🚨 CVE-2026-73007
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-73015
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-77489
Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-77906
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

🎖@cveNotify

🚨 CVE-2026-78455
Out-of-bounds read in Xbox allows an unauthorized attacker to disclose information with a physical attack.

🎖@cveNotify

🚨 CVE-2026-80075
Heap-based buffer overflow in Windows Work Folders allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-84000
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-84869
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

🎖@cveNotify

🚨 CVE-2026-88890
OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.

🎖@cveNotify

🚨 CVE-2026-88895
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

🎖@cveNotify

🚨 CVE-2026-88938
knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents from outside the intended project directory.

🎖@cveNotify

🚨 CVE-2026-78124
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.

🎖@cveNotify

🚨 CVE-2026-78131
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.

🎖@cveNotify

🚨 CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

🎖@cveNotify

🚨 CVE-2026-89060
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

🎖@cveNotify

🚨 CVE-2026-89241
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.

🎖@cveNotify

🚨 CVE-2026-89256
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.

🎖@cveNotify

🚨 CVE-2026-85083
The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially resulting in complete device compromise.

🎖@cveNotify

🚨 CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC.

🎖@cveNotify

🚨 CVE-2026-81861
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.

🎖@cveNotify

🚨 CVE-2026-89012
Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

🎖@cveNotify