CVSS Score: 8.8 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-87697
A remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.
CVSS Score: 8.8 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70007
An out-of-bounds write vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio allows unauthenticated remote attackers to execute arbitrary code via crafted pixel-shader bytecode or auto-converted clipboard payloads.
CVSS Score: 7.5 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70186
ASP.NET Core contains a thread deadlock vulnerability (CWE-833) that allows an unauthenticated remote attacker to cause a denial of service over the network by exhausting server thread pool resources.
CVSS Score: 8.8 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70035
CVE-2026-70035 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio caused by improper handling during the deserialization of untrusted data (CWE-502). An unauthenticated attacker can execute arbitrary code within the context of the affected process by delivering a crafted serialized payload.
CVSS Score: 7.5 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70183
An elevation of privilege vulnerability exists in ASP.NET Core and Microsoft Visual Studio due to improper synchronization during concurrent thread execution. Authenticated remote attackers with low privileges can exploit a timing window to manipulate shared resources and assume higher-level execution contexts.
CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107844
A path traversal vulnerability (CWE-22) in Contao CMS allows unauthenticated remote attackers to bypass directory boundary restrictions in ImagesController and access files within the project directory.
CVSS Score: 3.5 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107848
Contao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The RequestTokenListener component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an act parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as key= can execute without CSRF token verification when triggered by an authenticated user.
CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107843
Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.
CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107842
An information disclosure vulnerability in Contao CMS allows unauthenticated site visitors to view protected page titles, URLs, and text excerpts through search queries when protected page indexing is disabled after previously being enabled.
CVSS Score: 6.5 Published: 2026-10-09 Full Report: https://cvereports.com/reports/GHSA-G38J-7V97-X298
In Vikunja prior to version 2.6.0, relation creation via the CalDAV endpoint fails to invoke the TaskRelation.CanCreate authorization check. This missing access control allows an authenticated user to establish unauthorized relationships and perform write operations against any task, provided its unique identifier (UID) is known.
