WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product studio✕
Overview 919 matches · 63 in Waratek scope · 28 protected · 26 exploited · 11 CISA KEV · 84 public PoC · 32 EPSS ≥ 0.5
919matches 63in Waratek scope6.9% 28protected3.0% 26exploited2.8% 11CISA KEV1.2% 84public PoC9.1% 32EPSS ≥ 0.53.5%
Protected by Waratek 28 3.0% Rule in development 0 0.0% Mitigation candidate 2 0.2% No exploit published 33 3.6% Outside Waratek scope 11 1.2% Not applicable 845 91.9% Withdrawn CVE 0 0.0%
Critical 76 8.3% High 585 63.7% Medium 243 26.4% Low 15 1.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 28 3.0% partly blocked 0 0.0% not blocked 891 97.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 26 2.8% Working exploit published 60 6.5% Proof of concept only 54 5.9% Forecast only 5 0.5% No public exploit 774 84.2%
split by peak 132 / year
Not applicable: 845Outside Waratek scope: 11No exploit published: 33Mitigation candidate: 2Protected by Waratek: 28 Low: 15Medium: 243High: 585Critical: 76 not blocked: 891blocked by ARMR today: 28 No public exploit: 774Forecast only: 5Proof of concept only: 54Working exploit published: 60Exploited: 26
20004 Not applicable4 High2 Medium2 not blocked4 Working exploit published3 No public exploit1 20011 Not applicable1 High1 not blocked1 No public exploit1 20022 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20030 20043 Outside Waratek scope1 Not applicable2 High3 not blocked3 Working exploit published2 No public exploit1 20057 Not applicable7 High4 Medium3 not blocked7 Exploited1 No public exploit6 20069 Not applicable9 High5 Medium3 Low1 not blocked9 Exploited1 Working exploit published4 No public exploit4 200716 Not applicable16 High8 Medium8 not blocked16 Exploited1 Working exploit published8 No public exploit7 200817 Not applicable17 High14 Medium3 not blocked17 Exploited1 Working exploit published7 No public exploit9 200921 Not applicable21 High17 Medium4 not blocked21 Exploited3 Working exploit published8 No public exploit10 20106 Not applicable6 High3 Medium2 Low1 not blocked6 Working exploit published1 No public exploit5 201120 Not applicable20 High13 Medium7 not blocked20 Working exploit published3 No public exploit17 20129 Not applicable9 High3 Medium6 not blocked9 Working exploit published1 No public exploit8 201320 Not applicable20 High7 Medium11 Low2 not blocked20 Working exploit published2 No public exploit18 201415 Not applicable15 Critical3 High4 Medium8 not blocked15 Exploited3 Working exploit published1 No public exploit11 20158 No exploit published2 Not applicable6 High3 Medium4 Low1 not blocked8 No public exploit8 20167 Protected by Waratek1 Not applicable6 Critical2 High4 Medium1 blocked by ARMR today1 not blocked6 No public exploit7 201718 Protected by Waratek1 Outside Waratek scope1 Not applicable16 Critical6 High5 Medium7 blocked by ARMR today1 not blocked17 Working exploit published1 No public exploit17 201839 Protected by Waratek2 No exploit published1 Outside Waratek scope2 Not applicable34 Critical6 High22 Medium11 blocked by ARMR today2 not blocked37 Exploited3 Working exploit published4 No public exploit32 201946 Protected by Waratek6 Outside Waratek scope1 Not applicable39 Critical5 High24 Medium17 blocked by ARMR today6 not blocked40 Exploited2 Working exploit published4 Proof of concept only1 Forecast only1 No public exploit38 202089 Protected by Waratek5 No exploit published7 Outside Waratek scope3 Not applicable74 Critical4 High63 Medium20 Low2 blocked by ARMR today5 not blocked84 Exploited1 Working exploit published1 No public exploit87 2021102 Protected by Waratek7 No exploit published11 Outside Waratek scope1 Not applicable83 Critical6 High73 Medium20 Low3 blocked by ARMR today7 not blocked95 Exploited6 Working exploit published1 Proof of concept only1 Forecast only3 No public exploit91 202276 Protected by Waratek4 Mitigation candidate1 No exploit published8 Outside Waratek scope1 Not applicable62 Critical6 High53 Medium16 Low1 blocked by ARMR today4 not blocked72 Exploited1 Working exploit published2 Proof of concept only4 No public exploit69 2023113 Protected by Waratek1 Mitigation candidate1 No exploit published2 Not applicable109 Critical14 High74 Medium24 Low1 blocked by ARMR today1 not blocked112 Exploited2 Working exploit published2 Proof of concept only12 Forecast only1 No public exploit96 202487 No exploit published1 Not applicable86 Critical7 High60 Medium19 Low1 not blocked87 Working exploit published1 Proof of concept only8 No public exploit78 202552 Protected by Waratek1 No exploit published1 Not applicable50 Critical7 High34 Medium11 blocked by ARMR today1 not blocked51 Working exploit published3 Proof of concept only6 No public exploit43 2026132 Outside Waratek scope1 Not applicable131 Critical10 High86 Medium34 Low2 not blocked132 Exploited1 Proof of concept only22 No public exploit109
200220052008201120142017202020232026
919 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 10 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-96957 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96222 High 2026-10-13 Not applicable No public exploit Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-88092 Critical 2026-10-13 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-85790 Medium 2026-10-13 Not applicable No public exploit Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-70098 High 2026-10-13 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102238 Critical 2026-10-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102235 High 2026-10-13 Not applicable No public exploit Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102234 High 2026-10-13 Not applicable No public exploit Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-102231 High 2026-10-13 Not applicable No public exploit Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-81383 High 2026-09-08 Not applicable No public exploit Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81381 High 2026-09-08 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81380 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81379 High 2026-09-08 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81378 High 2026-09-08 Not applicable No public exploit Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81377 Medium 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-81376 Critical 2026-09-08 Not applicable No public exploit Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81357 High 2026-09-08 Not applicable No public exploit Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81356 High 2026-09-08 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78462 High 2026-09-08 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78461 High 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-77907 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-77906 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-71328 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-70334 High 2026-09-08 Not applicable No public exploit Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-69806 High 2026-09-08 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69805 High 2026-09-08 Not applicable No public exploit External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69439 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69304 Medium 2026-09-08 Not applicable No public exploit Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-65669 Critical 2026-09-08 Not applicable No public exploit Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58649 Medium 2026-09-08 Not applicable No public exploit Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-80098 Critical 2026-09-03 Not applicable No public exploit Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62906 High 2026-09-03 Not applicable No public exploit Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.
CVE-2026-70354 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-70336 High 2026-08-11 Not applicable No public exploit Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-70335 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-69320 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-69306 High 2026-08-11 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69278 High 2026-08-11 Not applicable No public exploit Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-62909 High 2026-08-11 Not applicable No public exploit Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-62902 Medium 2026-08-11 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62901 High 2026-08-11 Not applicable No public exploit Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-62900 Medium 2026-08-11 Not applicable No public exploit Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62899 Medium 2026-08-11 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-62898 High 2026-08-11 Not applicable No public exploit Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-62897 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-62886 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62871 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-59113 High 2026-08-11 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-58650 High 2026-08-11 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47285 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-17583 High 2026-08-05 Not applicable No public exploit The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.
CVE-2026-9128 High 2026-07-14 Not applicable No public exploit A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.
CVE-2026-9127 High 2026-07-14 Not applicable No public exploit A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
CVE-2026-9108 Medium 2026-07-14 Not applicable No public exploit A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
CVE-2026-57102 High 2026-07-14 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-57101 High 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-50659 Medium 2026-07-14 Not applicable No public exploit Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50651 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50649 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-50648 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50646 High 2026-07-14 Not applicable No public exploit Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50528 High 2026-07-14 Not applicable No public exploit Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-50527 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50526 High 2026-07-14 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
CVE-2026-50525 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50524 High 2026-07-14 Not applicable No public exploit Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50520 High 2026-07-14 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-47305 High 2026-07-14 Not applicable No public exploit Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2026-47304 Critical 2026-07-14 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47303 High 2026-07-14 Not applicable No public exploit Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47302 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-47300 High 2026-07-14 Not applicable No public exploit Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47282 Medium 2026-07-14 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-45496 Medium 2026-07-14 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-9143 Medium 2026-06-19 Not applicable No public exploit There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen.  This may silently discard high bits if a size value exceeded the target type's range. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-9142 Critical 2026-06-19 Not applicable No public exploit There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48141 Medium 2026-06-19 Not applicable No public exploit There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhaustion.  This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48140 High 2026-06-19 Not applicable No public exploit There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service. Successful exploitation requires an attacker to supply a specially crafted message containing an out-of-range value. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48139 High 2026-06-19 Not applicable No public exploit There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by triggering a crash.  Successful exploitation requires an attacker to provide an unknown value to the data moniker service. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48138 High 2026-06-19 Not applicable No public exploit There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48137 Critical 2026-06-19 Not applicable No public exploit There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution.  Successful exploitation requires an attacker  to supply a specially crafted Moniker protobuf message.  This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48569 High 2026-06-09 Not applicable No public exploit Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47292 High 2026-06-09 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-47287 Medium 2026-06-09 Not applicable No public exploit Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-47284 Medium 2026-06-09 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-47281 Critical 2026-06-09 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-45591 High 2026-06-09 Not applicable No public exploit Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45482 High 2026-06-09 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-40376 High 2026-06-09 Not applicable No public exploit Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41613 High 2026-05-12 Not applicable No public exploit Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41611 High 2026-05-12 Not applicable No public exploit Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-41610 Medium 2026-05-12 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-41109 High 2026-05-12 Not applicable No public exploit Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-32177 High 2026-05-12 Not applicable No public exploit Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32175 Medium 2026-05-12 Not applicable No public exploit A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
CVE-2026-7023 Low 2026-04-26 Not applicable Proof of concept only A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-32203 High 2026-04-14 Not applicable No public exploit Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32178 High 2026-04-14 Not applicable No public exploit Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-5709 High 2026-04-06 Not applicable No public exploit Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
‹ prev page 1 of 10 next ›