CVE-2026-70266

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-70251

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-70267

Microsoft Office SharePoint Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.2 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-85891

Azure HDInsight Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsights

CVE-2026-21413

LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Libraw

Products

Libraw

CVE-2026-105732

SysInternals Elevation of Privilege Vulnerability

Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Sysinternals Suite

CVE-2026-105725

Windows Security App Elevation of Privilege Vulnerability

Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Security App

CVE-2026-109771

Information disclosure in the WebRTC: Networking component

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-109777

Information disclosure in the Storage: IndexedDB component

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-65148

Stack-based Buffer Overflow in NVIDIA DALI Leading to Code Execution and Data Compromise

NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Dali

CVE-2026-88763

Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Service Interconnect

CVE-2026-109768

Denial-of-service in the Site Reports component

Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109769

Information disclosure in the Networking: Cache component

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-84320

Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

0xjacky

Products

Nginx-ui

CVE-2026-84319

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

0xjacky

Products

Nginx-ui

CVE-2026-82416

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-62367

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go-vikunja

Products

Vikunja

CVE-2026-59977

ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

C4illin

Products

Convertx

CVE-2026-54454

OpenCATS: Authenticated RCE in the Import module

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Opencats

Products

Opencats

CVE-2026-49483

Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Codefori

Products

Vscode-ibmi