The internet is broken right now.

Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Auth & access OS & kernel

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

Code execution Web app

The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests.

Auth & access Web app

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Memory safety

Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Disclosure

External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.

Other

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface.

Code execution Network gear

The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings.

Auth & access Web app

Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Other

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety Microsoft 365 Apps

Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.

Memory safety

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

Memory safety

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Memory safety

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.

Memory safety OS & kernel

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.

Denial of service Library

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network.

Other Server

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

Code execution Web app

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request.

Injection Network gear

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Auth & access Server

Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

Auth & access Server

Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.

Auth & access

Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.

Other

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Memory safety Server

geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.

Denial of service Browser & mail

A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).

Memory safety Library

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Memory safety OS & kernel

Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

Auth & access

Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network.

Memory safety OS & kernel

Integer underflow (wrap or wraparound) in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges over a network.

Memory safety OS & kernel

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

XSS Server

IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.

Injection IBM Guardium Data Protection

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.

Injection Web app

A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password

Auth & access Network gear

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.

Denial of service

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.

Disclosure Network gear

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

Auth & access Server

Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.

Memory safety OS & kernel