Archive
13 October 2026
Vulnerabilities first published on this day (UTC), newest first.
2,293 results · Feed
-
High 7.3
MultiTail: Shell injection in execute-on-match command handling
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() …
-
Medium 5.4
Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/C…
-
High 7.1
Ente: Accepted emergency contact can bypass the recovery notice period
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using o…
-
Low 3.7
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can sub…
-
High 8.5
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates…
-
Medium 4.3
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, c…
-
High 8.1
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider l…
-
Critical 10.0
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated call…
-
High 7.5
Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at…
-
High 7.5
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored …
-
High 7.5
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker wh…
-
High 7.0
Windows Autopilot Elevation of Privilege Vulnerability
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows SmartScreen Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.8
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Backup Engine Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
Critical 9.8CVE-2026-105016 Public exploit
Microsoft QUIC Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Framework Tampering Vulnerability
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
-
High 8.8
Microsoft Office OneNote Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kerberos Elevation of Privilege Vulnerability
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
High 7.5
Active Directory Federation Services (AD FS) Spoofing Vulnerability
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
High 7.5
Windows Internet Information Services Denial of Service Vulnerability
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.