CVE Vulnerability Catalog

A heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

A race condition in the Windows Native WiFi Miniport Driver allows concurrent execution using shared resources with improper synchronization.

The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records are exposed without any verification of the requester's identity or permissions.

The CosyVoice project contains an insecure deserialization vulnerability in its model loading process. This allows an attacker to execute malicious code on the victim's system by loading a specially crafted model directory.

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 may allow an escalation of privilege. An unprivileged software adversary with authenticated access can perform a low complexity attack leading to privilege escalation.

CVE-2026-20714 is a vulnerability related to out-of-bounds write in some Intel(R) QAT software drivers for Windows before version 1.13. It may allow privilege escalation by an unprivileged attacker with authenticated access.

An out-of-bounds write vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.11 allows an attacker to execute unauthorized code or commands via specially crafted packets.

CVE-2025-53681 in Fortinet FortiMail (versions 7.6.0 to 7.6.3, 7.4.0 to 7.4.5, and 7.2.0 to 7.2.8) has an improper neutralization of special elements used in SQL commands, allowing an authenticated privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS requests.

An inconsistent user interface issue was addressed with improved state management. An app may be able to access sensitive user data.

An access issue was addressed with additional sandbox restrictions. An app may be able to break out of its sandbox.

YAML::Syck versions before 1.38 for Perl have an out-of-bounds read issue. This bug occurs in the base60 parsing code, potentially leading to unsafe memory reads.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had an SSRF vulnerability in the WAVS bridge. The computeDataVerify function called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had a vulnerability in its substring-based blocklist for command safety checks. This could be bypassed, allowing unauthorized command execution on the host.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had a vulnerability in the plugin-shell where agent-supplied commands were interpreted by the shell, allowing shell metacharacters to be used. This vulnerability is fixed in version 0.x.y-security-1.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had a vulnerability in the upload_wasm MCP tool, allowing file uploads without validation of the path, symlink targets, file size, or file format.

Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. An unprivileged software adversary with an unauthenticated user may enable remote code execution.

CVE-2026-20879 is a vulnerability related to an out-of-bounds write in the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2. This may lead to denial of service and data corruption with local access by a privileged user.

Integer overflow in the UEFI firmware for the Slim Bootloader may allow an escalation of privilege. A system software adversary with privileged access and a low complexity attack may enable local code execution.

A vulnerability in the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 allows for out-of-bounds read, potentially leading to denial of service. A privileged user adversary may exploit this vulnerability to expose data.

CVE-2026-20738 is a vulnerability related to untrusted pointer dereference in Intel(R) QuickAssist Adapter 8960 software before version 1.13, which may lead to privilege escalation. An attacker with low complexity requirements can exploit this flaw to gain higher privileges without user interaction.