| CVE-2026-73024 | Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-73023 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-73019 | Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network. | medium | 2026-09-24 |
| CVE-2026-73018 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-73016 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-73013 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-73012 | Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network. | high | 2026-09-24 |
| CVE-2026-73009 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | critical | 2026-09-24 |
| CVE-2026-72987 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-72986 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-72985 | Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack. | medium | 2026-09-24 |
| CVE-2026-72983 | Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network. | critical | 2026-09-24 |
| CVE-2026-72982 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. | critical | 2026-09-24 |
| CVE-2026-72981 | Use after free in IP Helper allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-72979 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | critical | 2026-09-24 |
| CVE-2026-72978 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | high | 2026-09-24 |
| CVE-2026-72967 | Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-72966 | Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally. | medium | 2026-09-24 |
| CVE-2026-72965 | Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-72959 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | high | 2026-09-24 |
| CVE-2026-72957 | Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally. | high | 2026-09-24 |
| CVE-2026-72954 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-72950 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | critical | 2026-09-24 |
| CVE-2026-72948 | Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-72944 | Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-72943 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-72942 | Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network. | medium | 2026-09-24 |
| CVE-2026-72939 | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network. | medium | 2026-09-24 |
| CVE-2026-72937 | Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. | medium | 2026-09-24 |
| CVE-2026-72935 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | medium | 2026-09-24 |
| CVE-2026-72933 | Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-72932 | Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. | high | 2026-09-24 |
| CVE-2026-72931 | Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally. | medium | 2026-09-24 |
| CVE-2026-72930 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally. | high | 2026-09-24 |
| CVE-2026-72927 | Heap-based buffer overflow in Winsock allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-72861 | The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text. | medium | 2026-09-24 |
| CVE-2026-72854 | msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport. | medium | 2026-09-24 |
| CVE-2026-72852 | hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, and both feed xcalloc directly. A .cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l.size*l.size*l.c / l.groups where the allocation divided before multiplying, and reads and writes through the undersized buffer. Loading the crafted .cfg for inference or training is sufficient and no valid .weights file is required. The reported proof of concept observed a heap buffer overflow read in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in a release build of the same input, indicating an out-of-bounds write. | high | 2026-09-24 |
| CVE-2026-72848 | SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no domain comparison and no check for private, loopback or link-local destinations. An attacker who controls or influences an ingested sitemap can therefore point a nested sitemap entry at an internal address and make the server fetch it even when the deploying application set restrict_to_same_domain to True specifically to confine outbound requests. The fetched content is parsed and surfaces in the returned Documents, so internal responses are disclosed to the caller rather than merely requested. | high | 2026-09-24 |
| CVE-2026-72847 | broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted. | low | 2026-09-24 |
| CVE-2026-72846 | Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly. | medium | 2026-09-24 |
| CVE-2026-72844 | The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their parametric arguments escaped checking. A metaprogram running in the Lean process can register an ill-typed nested inductive whose constructor applies a .proj C 0 projection to a value of the unrelated type W, and the kernel admits the declaration through the ordinary checked addDecl path at maximum kernel checking, without sorry, unsafeCast, debug.skipKernelTC, addDeclWithoutChecking, FFI, or a modified .olean file. The result is a type confusion yielding a proof of False that carries no axioms, from which any proposition can be derived. The published proof of concept additionally pads two expressions until their hashes and approximate depths collide, which defeats kernel caching; that is the technique used to reach the flaw, not its cause. Exploitation requires running a metaprogram in-process, for example by building a project or importing a malicious Lake dependency. | medium | 2026-09-24 |
| CVE-2026-72843 | The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private". | critical | 2026-09-24 |
| CVE-2026-72818 | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition. | high | 2026-09-24 |
| CVE-2026-72815 | go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0. | medium | 2026-09-24 |
| CVE-2026-72814 | The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files. | medium | 2026-09-24 |
| CVE-2026-72813 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header. | medium | 2026-09-24 |
| CVE-2026-72776 | AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution. | critical | 2026-09-24 |
| CVE-2026-72744 | Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID. Production builds are unaffected. Fixed in 4.5.1 and 3.21.10. | medium | 2026-09-24 |
| CVE-2026-72742 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint. | critical | 2026-09-24 |
