| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access. |
| The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate. |
| The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate. |
| The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate. |
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. |
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. |
| A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. |
| A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources. |
| Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
| A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application. |
| A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws. |
