| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. |
| Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network. |
| Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5. |
| Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
| Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. |
| Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. |
| Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. |
| Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. |
| A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability. |
| Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. |
| Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally. |
| Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally. |
| Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network. |
| Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally. |
| Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally. |
| Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
