Archive
14 July 2026
Vulnerabilities first published on this day (UTC), newest first.
8 results · Clear filters · Feed
-
Medium 6.3CVE-2026-45067 Public exploit
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a secur…
-
Medium 6.3CVE-2026-57973 Public exploit
Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
-
Medium 4.7CVE-2026-50657 Public exploit
Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
-
Medium 6.5CVE-2026-34348 Public exploit
Windows Event Logging Service Information Disclosure Vulnerability
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
-
Medium 5.3
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
KEV Jul 14, 2026 -
Medium 4.3CVE-2026-15718 Public exploit
Invalid pointer in the JavaScript: WebAssembly component
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.
-
Medium 4.8CVE-2026-12478 Public exploit
Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload lengt…
-
Medium 6.4CVE-2026-36214 Public exploit
osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerabl…