CVE Vulnerability Catalog

A null pointer dereference exists in the Windows Storport Miniport Driver. An unauthenticated attacker can exploit this flaw to cause a denial of service over a network.

Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.

A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system.

Podatność CVE-2026-32170 dotyczy podwójnego zwolnienia pamięci w edytorze Rich Text w systemie Windows, co pozwala autoryzowanemu atakującemu na lokalne podniesienie uprawnień.

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions.

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows unauthenticated users to delete arbitrary memory records without verifying identity or permissions. A remote attacker can send unauthenticated DELETE requests to remove any memory entry from the database, leading to unauthorized data loss and potential denial of service.

The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a CREATE TABLE SQL statement.

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can send unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service.

Fortinet FortiDeceptor (6.0.0 through 6.0.2, 5.3.0 through 5.3.3, 5.2.0 through 5.2.1, all 5.1 and 5.0 versions) contains an argument injection vulnerability due to improper neutralization of argument delimiters in a command. An authenticated attacker with at least read-only admin permission may read log files via crafted HTTP requests.

Fortinet FortiNDR versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.9, 7.2 all versions, 7.1 all versions, and 7.0 all versions contain an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. An authenticated attacker may execute unauthorized code or commands via specifically crafted HTTP requests.

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer and FortiManager allows an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. Exploitation depends on internal locks being aligned, which is out of the attacker's control.

An OS command injection vulnerability in Fortinet FortiAP. An authenticated attacker can exploit it to execute unauthorized code or commands via a specially crafted CLI command.

An OS Command Injection vulnerability in Fortinet FortiAP allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.

Missing authorization in the PAM module of Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This affects Devolutions Server 2026.1.6.0 through 2026.1.11.0 and 2025.3.16.0 and earlier.

The WPMU DEV Hustle plugin (through 7.8.10.1) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

Uncontrolled search path in Intel(R) Connectivity Performance Suite installers before version 50.25.1121.193 in Ring 3 may allow privilege escalation. Attack requires authenticated user, high complexity, and user interaction.

An uncontrolled search path vulnerability in AI Playground software before version 3.0.0 alpha within Ring 3 may allow privilege escalation. An authenticated unprivileged adversary with a high-complexity local attack requiring user interaction can exploit it.

Improper buffer restrictions in the Display Virtualization for Windows OS driver software within Ring 2: Device Drivers may allow a denial of service. An authenticated unprivileged adversary with a low complexity attack may cause denial of service via local access.

Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure. A privileged system software adversary with a high complexity attack may enable data exposure via local access.

A vulnerability in some Intel(R) Processors caused by shared microarchitectural predictor state influencing transient execution within VMX non-root (guest) operation may allow information disclosure. An unprivileged authenticated adversary with a high-complexity local attack may expose data.