The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

Windows NTFS Remote Code Execution Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Server Update Service Elevation of Privilege Vulnerability

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows Search Component Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

Adobe Experience Manager | Improper Input Validation (CWE-20)

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Windows Broadcast DVR User Service Information Disclosure Vulnerability

Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

This CVE ID has been rejected by runZero as unused.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own. This issue affects ash: from 1.22.0 before 3.37.2.

Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Host Header Injection in HAVELSAN's Liman MYS

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-3985.

Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio

Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.