Tue, Jun 09 · 04:16 PM CDTCVE-2026-10520
10.0/10 · Must read/watchNVDvuln
Summary
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVECVE-2026-10520
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 09 · 04:16 PM CDT
ModifiedThu, Jun 11 · 08:16 PM CDT
CVE-2026-25089
9.8/10 · Must read/watchNVDvuln
Summary
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthentic
CVECVE-2026-25089
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 09 · 04:16 PM CDT
ModifiedThu, Jun 11 · 09:39 PM CDT
CVE-2026-44815
9.8/10 · Must read/watchNVDvuln
Summary
Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.
CVECVE-2026-44815
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 05:35 PM CDT
CVE-2026-9170
9.8/10 · Must read/watchNVDvuln
Summary
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.
CVECVE-2026-9170
SeverityCRITICAL
TypeUPDATED
PublishedTue, May 26 · 06:16 PM CDT
ModifiedThu, Jun 11 · 02:16 PM CDT
CVE-2026-42904
9.6/10 · Must read/watchNVDvuln
Summary
Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.
CVECVE-2026-42904
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 04:15 PM CDT
CVE-2026-7876
9.1/10 · Must read/watchNVDvuln
Summary
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.
CVECVE-2026-7876
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedThu, Jun 11 · 02:16 PM CDT
CVE-2026-1784
8.8/10 · Worth your timeNVDvuln
Summary
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
CVECVE-2026-1784
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 02 · 09:16 AM CDT
ModifiedThu, Jun 11 · 12:16 PM CDT
CVE-2026-47101
8.8/10 · Worth your timeNVDvuln
Summary
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only r
CVECVE-2026-47101
SeverityHIGH
TypeUPDATED
PublishedThu, May 21 · 09:16 PM CDT
ModifiedThu, Jun 11 · 07:16 PM CDT
CVE-2026-47102
8.8/10 · Worth your timeNVDvuln
Summary
LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full admini
CVECVE-2026-47102
SeverityHIGH
TypeUPDATED
PublishedThu, May 21 · 09:16 PM CDT
ModifiedThu, Jun 11 · 07:16 PM CDT
CVE-2026-44810
8.4/10 · Worth your timeNVDvuln
Summary
Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.
CVECVE-2026-44810
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 05:13 PM CDT
CVE-2026-45456
8.4/10 · Worth your timeNVDvuln
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVECVE-2026-45456
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 06:40 PM CDT
CVE-2026-45458
8.4/10 · Worth your timeNVDvuln
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVECVE-2026-45458
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 03:37 PM CDT
CVE-2026-45607
8.4/10 · Worth your timeNVDvuln
Summary
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
CVECVE-2026-45607
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 06:37 PM CDT
CVE-2026-45641
8.4/10 · Worth your timeNVDvuln
Summary
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
CVECVE-2026-45641
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 05:42 PM CDT
CVE-2026-44822
8.2/10 · Worth your timeNVDvuln
Summary
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVECVE-2026-44822
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 06:38 PM CDT
CVE-2026-42981
8.1/10 · Worth your timeNVDvuln
Summary
Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
CVECVE-2026-42981
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 04:55 PM CDT
CVE-2026-42987
8.1/10 · Worth your timeNVDvuln
Summary
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
CVECVE-2026-42987
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 03:46 PM CDT
CVE-2026-45599
8.1/10 · Worth your timeNVDvuln
Summary
Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.
CVECVE-2026-45599
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 02:57 PM CDT
CVE-2026-45635
8.1/10 · Worth your timeNVDvuln
Summary
Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.
CVECVE-2026-45635
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 06:36 PM CDT
CVE-2026-45588
7.9/10 · Worth your timeNVDvuln
Summary
Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CVECVE-2026-45588
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 03:25 PM CDT
CVE-2025-24170
7.8/10 · Worth your timeNVDvuln
Summary
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.
CVECVE-2025-24170
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 31 · 11:15 PM CDT
ModifiedThu, Jun 11 · 07:16 PM CDT
CVE-2025-43407
7.8/10 · Worth your timeNVDvuln
Summary
This issue was addressed with improved entitlements. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. An app may be able to break out of its sandbox.
CVECVE-2025-43407
SeverityHIGH
TypeUPDATED
PublishedTue, Nov 04 · 02:15 AM CST
ModifiedThu, Jun 11 · 07:16 PM CDT
CVE-2026-40409
7.8/10 · Worth your timeNVDvuln
Summary
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
CVECVE-2026-40409
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 05:06 PM CDT
CVE-2026-41092
7.8/10 · Worth your timeNVDvuln
Summary
Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.
CVECVE-2026-41092
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 05:04 PM CDT
CVE-2026-42829
7.8/10 · Worth your timeNVDvuln
Summary
Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally.
CVECVE-2026-42829
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 09 · 05:17 PM CDT
ModifiedThu, Jun 11 · 05:02 PM CDT
