•about 22 hours ago•CVE-2026-87697
8.8CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling
A remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.
13 views•5 min read
•about 23 hours ago•CVE-2026-70007
8.8CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem
An out-of-bounds write vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio allows unauthenticated remote attackers to execute arbitrary code via crafted pixel-shader bytecode or auto-converted clipboard payloads.
9 views•6 min read
•about 23 hours ago•CVE-2026-70186
7.5CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock
ASP.NET Core contains a thread deadlock vulnerability (CWE-833) that allows an unauthenticated remote attacker to cause a denial of service over the network by exhausting server thread pool resources.
9 views•5 min read
•1 day ago•CVE-2026-70035
8.8CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime
CVE-2026-70035 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio caused by improper handling during the deserialization of untrusted data (CWE-502). An unauthenticated attacker can execute arbitrary code within the context of the affected process by delivering a crafted serialized payload.
11 views•6 min read
•1 day ago•CVE-2026-70183
7.5CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition
An elevation of privilege vulnerability exists in ASP.NET Core and Microsoft Visual Studio due to improper synchronization during concurrent thread execution. Authenticated remote attackers with low privileges can exploit a timing window to manipulate shared resources and assume higher-level execution contexts.
11 views•5 min read
•4 days ago•CVE-2026-107844
5.3CVE-2026-107844: Path Traversal Vulnerability in Contao ImagesController
A path traversal vulnerability (CWE-22) in Contao CMS allows unauthenticated remote attackers to bypass directory boundary restrictions in ImagesController and access files within the project directory.
20 views•5 min read
•4 days ago•CVE-2026-107848
3.5CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests
Contao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The `RequestTokenListener` component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an `act` parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as `key=` can execute without CSRF token verification when triggered by an authenticated user.
11 views•5 min read
•4 days ago•CVE-2026-107843
5.3CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS
Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.
11 views•4 min read
•4 days ago•CVE-2026-107842
5.3CVE-2026-107842: Information Disclosure via Stale Indexing in Contao Search Module
An information disclosure vulnerability in Contao CMS allows unauthenticated site visitors to view protected page titles, URLs, and text excerpts through search queries when protected page indexing is disabled after previously being enabled.
12 views•4 min read
•4 days ago•GHSA-G38J-7V97-X298
6.5GHSA-G38J-7V97-X298: Missing Authorization Check in Vikunja CalDAV Task Relation Creation
In Vikunja prior to version 2.6.0, relation creation via the CalDAV endpoint fails to invoke the TaskRelation.CanCreate authorization check. This missing access control allows an authenticated user to establish unauthorized relationships and perform write operations against any task, provided its unique identifier (UID) is known.
14 views•5 min read
•4 days ago•GHSA-3HC7-R24J-RPWC
6.8GHSA-3hc7-r24j-rpwc: Cross-Project Task Disclosure via Subtask Expansion in Vikunja
A cross-project information disclosure vulnerability in Vikunja allows authenticated users with read access to one project to view private task details from unauthorized projects via subtask expansion parameters.
10 views•5 min read
•4 days ago•GHSA-8WVG-R2J4-3737
4.3GHSA-8wvg-r2j4-3737: Email Address Exposure in Vikunja Task Assignees API
An information disclosure vulnerability in Vikunja allows authenticated users with read access to a task to expose private email addresses of assigned users through the API task assignees endpoint due to an unmasked database query.
10 views•5 min read