Full List

Search

Recent Vulnerabilities

• CVE-2026-70321 • published on August 11, 2026 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-70320 • published on August 11, 2026 Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
• CVE-2026-70319 • published on August 11, 2026 Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-70318 • published on August 11, 2026 Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-70317 • published on August 11, 2026 Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-70316 • published on August 11, 2026 Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
• CVE-2026-70311 • published on August 11, 2026 Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-70307 • published on August 11, 2026 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
• CVE-2026-70130 • published on August 11, 2026 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-6998 • published on April 25, 2026 A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipulation of the argument Owner results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
• CVE-2026-6995 • published on April 25, 2026 A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345. The impacted element is an unknown function of the file /index.asp of the component New User Page. Performing a manipulation of the argument User name results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
• CVE-2026-6992 • published on April 25, 2026 A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
• CVE-2026-70452 • published on August 13, 2026 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
• CVE-2026-70447 • published on August 5, 2026 Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
• CVE-2026-70440 • published on August 5, 2026 Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
• CVE-2026-70435 • published on August 5, 2026 A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
• CVE-2026-70434 • published on August 5, 2026 A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
• CVE-2026-70430 • published on August 5, 2026 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.
• CVE-2026-70378 • published on August 5, 2026 imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.
• CVE-2026-70375 • published on August 5, 2026 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.