New
CVE-2026-26006: Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The autogpt before 0.6.32 is vulnerable to Regular Expression Denial of Service due to the use of regex at Code Extraction Block. The two Regex are u...
CVE-2025-12699: ZOLL ePCR IOS Mobile Application Insertion of Sensitive Information into Externally-Accessible File or Directory: The ZOLL ePCR IOS application reflects unsanitized user input into a WebView. Attacker-controlled strings placed into PCR fields (run number, incident, call sign, notes) are interpreted as HTML/JS when the app prints or renders that content. In the proof of concept (POC), injected s...
CVE-2026-1507: Uncaught Exception vulnerability in AVEVA PI Data Archive: The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.
CVE-2026-1495: Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent: The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized access to the proxy server.
CVE-2026-1763: Enervista UR Setup DLL Hijacking: Vulnerability in GE Vernova Enervista UR Setup on Windows.This issue affects Enervista: 8.6 and previous versions.
Updated
CVE-2026-25808: Hollo DMs get leaked and can be seen on Webfinger Browser: Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
CVE-2026-21237: Windows Subsystem for Linux Elevation of Privilege Vulnerability: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVE-2026-25807: Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell: ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who co...
CVE-2026-21232: Windows HTTP.sys Elevation of Privilege Vulnerability: Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
CVE-2025-15318: Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.: Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.
CISA Known Exploited Vulnerabilities
CVE-2026-21519 Microsoft Windows: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.
CVE-2026-21513 Microsoft Windows: Microsoft Internet Explorer contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21525 Microsoft Windows: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.
CVE-2026-21514 Microsoft Office: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
CVE-2026-21533 Microsoft Windows: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.