Trending Vulnerabilities

CVE-2026-45659 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data in Microsoft Office SharePoint. Microsoft states that an authorized attacker can exploit the flaw over the network to execute code on the SharePoint server. Public reporting and vendor/advisory context indicate exploitation requires authentication but only low privileges, with Site Member permissions being sufficient. The issue affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The vulnerable condition is triggered when SharePoint processes attacker-controlled serialized data, resulting in arbitrary code execution in the server context.

CVE-2026-46817 is a critical vulnerability in the Oracle Payments product of Oracle E-Business Suite, specifically the File Transmission component, affecting supported versions 12.2.3 through 12.2.15. Oracle describes the issue as easily exploitable by an unauthenticated attacker with network access via HTTP and no user interaction. Supporting reporting indicates exploitation targets the Oracle Payments File Transmission endpoint, including /OA_HTML/ibytransmit, and observed attack behavior included crafted requests that triggered unauthenticated arbitrary file reads such as /etc/passwd. Multiple sources characterize the flaw as involving missing or improper authentication on a critical function, with some reporting also describing improper privilege management. Successful exploitation can compromise Oracle Payments and may enable full takeover of the affected application environment.

CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software affecting versions 5.5.15 and earlier and 6.0 pre-release versions before 6.0 RC2. When OpenID Connect (OIDC) authentication is configured, SimpleHelp accepts identity tokens submitted during login without verifying their cryptographic signature. This improper signature validation in the OIDC/JWT token handling path allows an attacker to forge an identity token containing arbitrary identity claims. In vulnerable configurations, the forged token is accepted as valid and the attacker is granted a fully authenticated Technician session. Public reporting also indicates the issue is especially relevant where OIDC is linked to Technician groups and group-authenticated logins are enabled.

CVE-2026-8451 is a high-severity, pre-authentication insufficient input validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can cause an out-of-bounds read / memory overread when the appliance is configured as a SAML Identity Provider (IdP). Reporting indicates the flaw is in NetScaler’s handling of SAML authentication requests, specifically its XML parser for SAML AuthnRequest processing. The parser can read beyond the intended bounds of XML attribute values when presented with malformed SAML input, including cases involving unquoted attribute values followed by a newline. Successful exploitation can cause fragments of appliance memory to be returned to the requester, including via the NSC_TASS cookie in HTTP responses. The issue has been described as CitrixBleed-like because it is a remote memory disclosure flaw affecting internet-facing NetScaler appliances in SAML IdP deployments.

CVE-2026-8037 is a critical remote code execution vulnerability affecting Progress Kemp LoadMaster / Progress ADC products. The issue is exposed through the LoadMaster API, particularly the /accessv2 endpoint, and allows unauthenticated attackers to execute arbitrary OS commands on the appliance. Available reporting indicates the root cause is improper handling of user-supplied input in the escape_quotes() function within the access executable: older versions allocate an uninitialized buffer and fail to append a null terminator to the sanitized string, causing reads into adjacent heap memory. The apiuser parameter is then incorporated into a shell command, enabling command injection when crafted input and attacker-controlled adjacent request data are interpreted as shell input. The vulnerability affects LoadMaster GA 7.2.63.1 and earlier and LTSF 7.2.54.17 and earlier when the API feature is enabled.

CVE-2026-55200 is a critical client-side memory corruption vulnerability in libssh2 affecting versions through 1.11.1. The flaw is in ssh2_transport_read() in transport.c, where libssh2 accepts an attacker-controlled SSH packet_length value from a remote server without enforcing an upper bound before performing size arithmetic and allocation decisions. Multiple sources indicate this can trigger a 32-bit integer wraparound, leading to an undersized heap allocation followed by out-of-bounds heap writes during later packet processing. The issue is reachable during the SSH transport phase before authentication, so a malicious or compromised SSH server can trigger it as soon as a vulnerable client connects. Public reporting describes the upstream fix as adding a guard that rejects packet_length values greater than LIBSSH2_PACKET_MAXPAYLOAD; the fix was merged upstream in commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 / PR #2052.

CVE-2026-20230 is a server-side request forgery vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw is caused by improper input validation of specific HTTP requests in the WebDialer component/service. An unauthenticated remote attacker can send a crafted HTTP request to a vulnerable system and cause the application to make attacker-influenced internal requests. Cisco states that successful exploitation can allow the attacker to write files to the underlying operating system; public technical reporting further indicates the flaw has been used to drop JSP payloads/web shells via internal service abuse, creating a path to subsequent code execution and privilege escalation. Cisco notes the issue is only exploitable when the WebDialer service is enabled, and that WebDialer is disabled by default.

DirtyClone (CVE-2026-43503) is a Linux kernel local privilege escalation vulnerability in the networking stack’s sk_buff fragment-handling logic. Several frag-transfer helpers, notably __pskb_copy_fclone() and skb_shift(), failed to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving fragment descriptors from one skb to another. Similar omissions were also identified in skb_gro_receive(), skb_gro_receive_list(), tcp_clone_payload(), and skb_segment(). As a result, a destination skb could still reference externally owned or page-cache-backed pages while incorrectly reporting skb_has_shared_frag() as false. This breaks the invariant relied on by in-place writers to trigger copy-on-write via skb_cow_data() before modifying shared backing pages. In the documented exploit path, a packet cloned through nf_dup_ipv4()/xt_TEE or nft 'dup to <local>' reaches ESP input processing (esp4.c/esp6.c) with the shared-frag marker stripped, allowing in-place ESP/authencesn-ESN writes into page-cache-backed fragments. This can let a local attacker corrupt the page cache contents of privileged read-only files such as SUID binaries without modifying the on-disk file.

CVE-2026-46242 ('Bad Epoll') is a Linux kernel use-after-free race condition in the eventpoll/epoll subsystem, specifically in ep_remove() as reached via ep_remove_file(). The vulnerable logic clears file->f_ep while holding file->f_lock, but continues to use the associated struct file within that critical section, including operations that ultimately reach hlist_del_rcu() and spin_unlock(). A concurrent __fput() can observe the transient NULL in file->f_ep, take the eventpoll_release() fast path, skip eventpoll_release_file(), and proceed to f_op->release and file_free(). In the epoll-watches-epoll case, this can free the watched struct eventpoll while ep_remove() still holds references into its embedded refs hlist, causing hlist_del_rcu() to write through a stale epi->fllink.pprev pointer into freed kmalloc-192 memory. Because struct file is SLAB_TYPESAFE_BY_RCU, the freed file slot may also be recycled by alloc_empty_file() while ep_remove() is still operating on it, reinitializing f_lock and f_ep and enabling an attacker-controllable kmem_cache_free() against the wrong slab cache. The upstream fix pins the file with epi_fget() at the start of ep_remove() so __fput() cannot drive the file refcount to zero during the critical section, preventing both the struct file and watched struct eventpoll UAF conditions.

CVE-2026-46331 is a Linux kernel local privilege escalation vulnerability in the net/sched traffic-control subsystem, specifically the act_pedit packet editing path. The bug is in tcf_pedit_act(), which computed the copy-on-write writable range for skb_ensure_writable() once before iterating over edit keys using tcfp_off_max_hint. That precomputed range did not account for runtime header offsets introduced by typed keys, so later writes could resolve outside the region that had actually been made private. As a result, part of the packet write region could remain shared, enabling an out-of-bounds/partial copy-on-write write into shared page-cache-backed memory and causing page cache corruption. The upstream fix moves skb_ensure_writable() into the per-key loop so the actual write offset is known for each key, adds overflow checks on offset arithmetic, uses skb_cow() for negative offsets such as ingress Ethernet header edits that require headroom COW, and hardens offset_valid() against INT_MIN negation edge cases.

CVE-2025-3248 is a critical vulnerability in Langflow affecting versions prior to 1.3.0. The flaw is in the /api/v1/validate/code endpoint, which was reachable without authentication and processed attacker-supplied Python code during code validation. According to the provided content, Langflow parsed submitted code into an AST and then used Python compile/exec behavior in a way that allowed malicious decorators or default argument expressions to execute during validation; other provided context also states the endpoint accepted arbitrary Python code and passed it to exec() without requiring authentication. As a result, a remote attacker could send a crafted HTTP request to the endpoint and achieve arbitrary code execution on the host running Langflow.

CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, specifically in the Updates Environment Management component / Environment Management Hub (PSEMHUB), affecting supported versions 8.61 and 8.62. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Supporting reporting states the vulnerable surface includes PSEMHUB endpoints and that exploitation can lead to unauthenticated remote code execution and full platform takeover. Public reporting also notes the flaw was exploited as a zero-day in a broad campaign between at least May 27 and June 9, 2026, against roughly 300 vulnerable instances at more than 100 organizations. While some reporting characterizes the bug as missing authentication for a critical function and CISA maps it to CWE-306, other reporting has described it as involving the Environment Management Hub and related HTTP endpoints used by PeopleSoft.

CVE-2026-33825, also referred to as BlueHammer, is a local privilege escalation vulnerability in Microsoft Defender. Microsoft describes the issue as insufficient granularity of access control that allows an authorized attacker to elevate privileges locally. Supporting reporting indicates the exploit abuses the Microsoft Defender update/signature handling workflow and a race condition/TOCTOU condition involving Defender components running as SYSTEM. Public technical descriptions state the exploit chain leverages Defender definition update packages, Volume Shadow Copy, Cloud Files callbacks, and oplocks to manipulate privileged file operations, exposing sensitive registry hives such as SAM, SYSTEM, and SECURITY and enabling escalation from a low-privileged local account to SYSTEM.

CVE-2025-5777, commonly referred to as CitrixBleed 2, is a pre-authentication information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Citrix describes it as insufficient input validation leading to a memory overread when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. Technical analysis in the provided content indicates the vulnerable path is reachable via POST requests to /p/u/doAuthentication.do. A malformed POST body such as "login" without an equals sign can trigger flawed parsing in ns_get_username_password, causing a negative length value to be passed to memchr and converted to a very large unsigned size, resulting in an out-of-bounds read. Leaked memory is copied into the aaa_info username field and returned to the client in the InitialValue element of the authentication failure response. The leak is limited to roughly 0x7F bytes per request, but repeated requests can disclose varying memory contents. Reported exposed data includes session material, credentials, cookies, and potentially other sensitive in-memory data.

CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in Langflow affecting versions prior to 1.9.0. The flaw is in the public endpoint POST /api/v1/build_public_tmp/{flow_id}/flow, which is intentionally exposed for building public flows without authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow definitions instead of the persisted server-side flow data. Those flow definitions can include arbitrary Python code in node definitions, and the execution path ultimately passes that code to Python exec() without sandboxing or meaningful restrictions. Reported analysis places the vulnerable path through flow-building logic such as start_flow_build(), graph construction, component instantiation, and code evaluation helpers that culminate in exec(compiled_code, exec_globals). Because the endpoint is unauthenticated and accepts attacker-supplied executable flow content, a single crafted HTTP POST can execute arbitrary Python on the server as the Langflow process. This issue is distinct from CVE-2025-3248, which involved a different authenticated code-validation path.

CVE-2026-55957 is an important-severity authentication bypass vulnerability in Apache Tomcat affecting deployments that use JNDIRealm configured to authenticate binds using GSSAPI. The issue is described by Apache as a missing critical step in authentication, which allows an attacker to authenticate without providing the correct password under the vulnerable configuration. Affected versions are Apache Tomcat 11.0.0-M1 through 11.0.4, 10.1.0-M1 through 10.1.36, 9.0.0.M1 through 9.0.100, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.

CVE-2026-48276 is a critical unrestricted upload of file with dangerous type vulnerability in Adobe ColdFusion. It affects ColdFusion 2025.9, 2023.20, and earlier versions. The flaw allows an attacker to upload a malicious file type that can then be executed, resulting in arbitrary code execution in the context of the current user. The issue is remotely exploitable over the network, requires no privileges, and does not require user interaction. Adobe classifies the issue as CWE-434 and multiple sources in the provided content describe it as one of the maximum-severity ColdFusion vulnerabilities addressed in APSB26-68.

CVE-2026-50548 is a critical sandbox escape vulnerability in Cursor Desktop affecting versions prior to 3.0. Cursor runs agent-issued terminal commands inside a sandbox by default, and that sandbox grants write access to the command's working directory. The flaw is in how the agent can control the optional working_directory parameter of the run_terminal_cmd tool: by setting working_directory to an attacker-chosen path outside the intended project/workspace, the sandbox incorrectly expands its writable allow list to include that external location. As a result, a malicious or prompt-injected agent can write arbitrary files outside the workspace with the privileges of the logged-in user. Reported exploitation paths include overwriting the cursorsandbox helper so subsequent commands execute outside the sandbox, as well as writing to other sensitive user-controlled locations such as shell startup files.

CVE-2026-20245 is an authenticated local privilege-escalation and command-injection vulnerability in the CLI of Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond). The flaw is caused by insufficient validation of user-supplied input in file-processing functionality exposed through the tenant upload workflow. An attacker with the required privileges can upload a crafted file, including a malicious CSV such as the observed evil_tenant.csv, and trigger processing through the CLI tenant-upload mechanism. Because the uploaded content is not safely validated before being handled by privileged components, arbitrary shell commands can be injected and executed as root. Reporting tied exploitation to the command `request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0`, after which attackers modified files such as /etc/passwd and /etc/shadow and created a UID 0 account named troot. Cisco and Mandiant both reported in-the-wild exploitation prior to disclosure.

CVE-2026-8655 is a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The issue is described by Citrix as multiple memory overflow vulnerabilities that can trigger memory corruption, resulting in unpredictable or erroneous behavior and denial of service. Based on the available advisory content, the flaw is reachable only in specific NetScaler ADC deployment modes: when the appliance is configured as a load balancer of type Oracle, as a DNS Proxy, or as a DNS recursive resolver deployment. The provided sources do not identify the exact vulnerable function or code path, but they consistently characterize the bug class as memory overflow/memory corruption in those feature-specific processing paths.

CVE-2026-50160 is a critical mass assignment vulnerability in self-hosted Hoppscotch hoppscotch-backend 2026.4.1 and earlier. The flaw affects the unauthenticated POST /v1/onboarding/config endpoint used during onboarding. The global NestJS ValidationPipe is configured without whitelist: true, so request body properties not declared in SaveOnboardingConfigRequest are not stripped. In the service layer, these extra properties are iterated and processed as InfraConfig entries. Because sensitive keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker can submit crafted onboarding data that overwrites these secrets in the database. The issue is exploitable against fresh instances before onboarding completes, and also when no users exist or re-onboarding is enabled. By overwriting JWT_SECRET, the attacker gains control of the JWT signing key and can forge authentication tokens for arbitrary users, including administrators.

CVE-2026-12569 is a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM, including all CPS versions and releases prior to 11.0 M030. The flaw is described as improper input validation and is specifically exploitable through deserialization of untrusted data. An unauthenticated remote attacker can send a crafted malicious request to a reachable vulnerable instance, causing unsafe deserialization of attacker-controlled serialized objects and resulting in arbitrary code execution on the target system.

CVE-2026-43715 is a use-after-free vulnerability in Apple's WebKit engine, affecting Safari and Apple platforms that process web content. Apple states that processing maliciously crafted web content may lead to memory corruption. The issue was addressed through improved memory management and is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The available content does not identify the specific vulnerable function or code path.

CVE-2026-8452 is a high-severity memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw affects appliances when they are configured as a Gateway or as an AAA virtual server, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy deployments. The vendor description states that the vulnerability can lead to unpredictable or erroneous behavior and denial of service. The provided content does not identify a specific vulnerable function or code path beyond the affected Gateway/AAA roles and characterizes the issue generally as improper memory handling / memory overflow.