| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. |
| Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally. |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
| The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end. |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
| The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome. |
| Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network. |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25. |
| Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.
This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A. |
| Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2. |
| OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field |
| Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker. |
| When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach. |
