CVE Vulnerability Catalog

Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path running with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. Attackers can place malicious executables in the path to be executed with elevated privileges during service startup or system reboot.

Comodo Chromodo Browser version 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.

Fortitude HTTP version 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path.

Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalate privileges.

The Realtek High Definition Audio Driver version 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path.

A vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.

A vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings to escalate their privileges to Administrator level.

CVE-2026-49872 describes an improper authentication vulnerability in Apache APISIX that allows an attacker to authenticate with credentials from a different source when the cas-auth plugin is used in a route. This issue affects versions from 3.0.0 to 3.16.0.

The vulnerability in Line Desktop MCP allows unauthorized network clients to access features of the LINE Desktop application on Windows and Mac. In `--http-mode`, the server does not require authentication, enabling session initiation and access to chat history and message sending.

The 'Open Redirect' vulnerability in Apache APISIX allows an attacker to manipulate client headers, potentially leading to redirection to an untrusted site and exposure of the session token.

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service. Successful exploitation requires an attacker to provide an unknown value to the data moniker service.

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request.

CVE-2026-47339 in Apache APISIX has an incorrect authorization vulnerability that allows an attacker to authenticate using credentials from a different source. This issue affects versions from 2.14.1 through 3.16.0.

Improper Input Validation vulnerability in Apache APISIX allows an attacker to spoof identity headers by exploiting certain configuration in the forward-auth plugin. This issue affects versions from 2.12.0 through 3.16.0.

Versions of SIMA GmbH Bondix up to 1.25.7.5 on Linux contain an OS command injection vulnerability in the environment and tunnel configuration functionality. This allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration.

Software running as a non-privileged user may conduct improper GPU system calls, leading to mismanagement of resources and a write use after free scenario.

CVE-2026-34192 vulnerability affects software running as a non-privileged user that may conduct improper GPU system calls, leading to an error path and use-after-free of GPU page tables.

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo introduced a new vulnerability. The shared cleanup path in the HTTP server PUT process calls fx_file_close() even when the file was never opened, leading to undefined behavior, double-close issues, or memory corruption.