CVE Vulnerability Watch

updated daily

Vulnerability watch

idvulnerabilityseveritypublished

CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.Collabora Collabora Online – Built-in CODE Server Critical CVSS 9.2 23/10

CVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista VeloCloud Orchestrator Critical 23/10

CVE-2026-106931SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.EG Secure Solutions SiteGuard Server Edition Critical CVSS 7.8 20/10

CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens Software Center Critical 20/10

CVE-2026-96652Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server Critical 20/10

CVE-2026-96654Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server Critical 20/10

CVE-2026-96655Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server Critical 20/10

CVE-2026-96656Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.Plex Media Server Critical CVSS 7.2 20/10

CVE-2025-61624Fortinet Multiple Products Path Traversal VulnerabilityFortinet Multiple Products Critical 16/10

CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support Critical 16/10

CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.Atlassian Multiple Products Critical CVSS 7.5 15/10

CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityPalo Alto Networks PAN-OS Critical 14/10

CVE-2026-100153The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking. High CVSS 7.2 14/10

CVE-2026-101924The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link. High CVSS 7.2 14/10

CVE-2026-102251The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely. High CVSS 7.5 14/10

CVE-2026-103307The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid. High CVSS 8.6 14/10

CVE-2026-103422The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page. High CVSS 7.2 14/10

CVE-2026-103423The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier. High CVSS 7.5 14/10

CVE-2026-104749The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen. High CVSS 7.5 14/10

CVE-2026-104767The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it. High CVSS 7.5 14/10

CVE-2026-104800The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API. Critical CVSS 9.8 14/10

CVE-2026-104995The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8. High CVSS 8.1 14/10

CVE-2026-105133A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.Ahsay AhsayCBS Critical CVSS 7.3 14/10

CVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.Ahsay AhsayCBS Critical CVSS 10 14/10

CVE-2026-105429Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name. High CVSS 8 14/10

CVE-2026-107126The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data. High CVSS 8.8 14/10

CVE-2026-107508The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file. High CVSS 8.6 14/10

CVE-2026-107594The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise. Critical CVSS 10 14/10

CVE-2026-108473Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account. High CVSS 8.7 14/10

CVE-2026-110002The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request. Critical CVSS 9.8 14/10

CVE-2026-110359Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges. High CVSS 7.8 14/10

CVE-2026-110385A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.NVD analysis in progress High CVSS 8.7 14/10

CVE-2026-110392Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection. Critical CVSS 9.8 14/10

CVE-2026-110444TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user. High CVSS 8.8 14/10

CVE-2026-110445TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user. High CVSS 8.8 14/10

CVE-2026-110449Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. High CVSS 7.5 14/10

CVE-2026-110450Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification. High CVSS 8 14/10

CVE-2026-110455A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.NVD analysis in progress High CVSS 8.1 14/10

CVE-2026-110459A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.NVD analysis in progress High CVSS 8.6 14/10

CVE-2026-14765Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default). High CVSS 7.7 14/10

CVE-2026-17092The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script. High CVSS 8.1 14/10

CVE-2026-50218Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.NVD analysis in progress High CVSS 8.5 14/10

CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco Secure Email Gateway Critical 14/10

CVE-2026-77114The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it. High CVSS 7.2 14/10

CVE-2026-78193The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request. High CVSS 7.5 14/10

CVE-2026-82715Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A. High CVSS 7.9 14/10

CVE-2026-83592The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content. High CVSS 7.2 14/10

CVE-2026-87855The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Critical CVSS 9.8 14/10

CVE-2026-92097The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e. Critical CVSS 9.1 14/10

CVE-2026-92817The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.NVD analysis in progress High CVSS 8.8 14/10

CVE-2026-93388The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Critical CVSS 9.8 14/10

CVE-2026-93885The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode. High CVSS 7.2 14/10

CVE-2026-94377The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation. High CVSS 7.2 14/10

CVE-2026-95808The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source. High CVSS 7.5 14/10

CVE-2026-95816The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads. High CVSS 7.2 14/10

CVE-2026-96661The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability. High CVSS 7.5 14/10

CVE-2026-97398The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached. High CVSS 7.2 14/10

CVE-2026-97657The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration. Critical CVSS 9.8 14/10

CVE-2026-97668The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one. Critical CVSS 9.8 14/10

CVE-2024-34320ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. Critical CVSS 9.8 13/10

CVE-2024-34323ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request. Critical CVSS 10 13/10

CVE-2024-34324An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. Critical CVSS 9.1 13/10

CVE-2025-46773An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.NVD analysis in progress High CVSS 8.8 13/10

CVE-2025-57739An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.NVD analysis in progress High CVSS 8.8 13/10

CVE-2025-58771AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.NVD analysis in progress High CVSS 7.1 13/10

CVE-2025-58772AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.NVD analysis in progress High CVSS 8.2 13/10

CVE-2025-58773AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.NVD analysis in progress High CVSS 7.1 13/10

CVE-2025-58774AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.NVD analysis in progress High CVSS 8.3 13/10

CVE-2026-100111Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop High CVSS 7.8 13/10

CVE-2026-100112Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop High CVSS 7.8 13/10

CVE-2026-100113CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100114CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100115CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100117CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100118CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100119CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100120CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100121CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100122CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100123CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100124CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100127Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-100128Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-100129Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-100133Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-100135CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100136CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100137CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100138CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100139CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-100200Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7 13/10

CVE-2026-100201Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-100202Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critical CVSS 9.8 13/10

CVE-2026-100203Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-100205Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-100207Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-100209Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-100210Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-100211Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-100212Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-100214Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-100215Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-100216Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-100217Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-100218Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.1 13/10

CVE-2026-100219Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.Microsoft Windows 11 23h2 Critical CVSS 9.8 13/10

CVE-2026-100220Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-100222Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critical CVSS 9.8 13/10

CVE-2026-100225Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-101020An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges. High CVSS 7.8 13/10

CVE-2026-101294IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.NVD analysis in progress High CVSS 8.7 13/10

CVE-2026-102007The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL. High CVSS 7.2 13/10

CVE-2026-102073A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.NVD analysis in progress High CVSS 8.2 13/10

CVE-2026-102074A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-102075A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-102076A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-102189Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7 13/10

CVE-2026-102191Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7 13/10

CVE-2026-102192Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.Microsoft Windows Server 2019 High CVSS 7.5 13/10

CVE-2026-102193Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-102194Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-102195Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7 13/10

CVE-2026-102196Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-102197Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-102201Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-102202Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-102203Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-102204Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-102205Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-102207Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-102208Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-102209Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 26h1 High CVSS 7 13/10

CVE-2026-102210Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1809 Critical CVSS 9.8 13/10

CVE-2026-102211Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-102214Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-102215Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-102216Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-102217Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-102218Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-102220Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-102225Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-102226Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-102227Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-102231Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.NVD analysis in progress High CVSS 7.7 13/10

CVE-2026-102232Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-102233Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-102234Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.NVD analysis in progress High CVSS 7.4 13/10

CVE-2026-102235Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-102238Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.6 13/10

CVE-2026-102250CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device. High CVSS 8.6 13/10

CVE-2026-102562The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen. High CVSS 7.2 13/10

CVE-2026-102599Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-102699[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-102702[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-102849Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-102850Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-102855Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-102856Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-102857Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-102858Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.Microsoft Microsoft 365 High CVSS 8.8 13/10

CVE-2026-102860Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-102861Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-102862Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-102863Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-102866Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.1 13/10

CVE-2026-102869Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-102870Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-102982Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0. High CVSS 8.5 13/10

CVE-2026-102989TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-103030Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0. High CVSS 7.5 13/10

CVE-2026-103296CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-103297CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-103316The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy) High CVSS 7.1 13/10

CVE-2026-103418Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1. High CVSS 8.8 13/10

CVE-2026-103499IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-103553Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-103554Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-103555Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-103558Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-103565Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-103568Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-103569Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-103572Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-103575Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-103577Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-103821Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Designer High CVSS 7.8 13/10

CVE-2026-103830Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103832Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103833Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103834Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103835Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103836Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103837Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103838Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103839Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103840Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103841Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103842Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103843Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager High CVSS 7.8 13/10

CVE-2026-103844Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-103845Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-103846Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-103847Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-103848Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 9.9 13/10

CVE-2026-103849Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 10 13/10

CVE-2026-103851Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-103854Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-103928Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-103937Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0. High CVSS 8.7 13/10

CVE-2026-103966Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-103967Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-104085odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process. High CVSS 8.8 13/10

CVE-2026-104192Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release. Critical CVSS 9.6 13/10

CVE-2026-104252Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.Linuxfoundation Vitess Critical CVSS 9.8 13/10

CVE-2026-104340Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-104341Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-104342Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-104344Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-104345CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-104346Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop High CVSS 7.8 13/10

CVE-2026-104347Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop High CVSS 7.8 13/10

CVE-2026-104348Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop High CVSS 7.8 13/10

CVE-2026-104584reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions). Critical CVSS 9.8 13/10

CVE-2026-104585Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. Critical CVSS 9.8 13/10

CVE-2026-104816Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0. High CVSS 8.5 13/10

CVE-2026-104817Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0. High CVSS 8.7 13/10

CVE-2026-104875Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09. High CVSS 7.1 13/10

CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.Ivanti Connect Secure Critical CVSS 8.6 13/10

CVE-2026-104937Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token. The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process. High CVSS 8.1 13/10

CVE-2026-105003Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-105004Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-105005Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-105007An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability. The security update addresses the vulnerability by changing how ndis.sys validates buffer length.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-105008No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.NVD analysis in progress Critical CVSS 9 13/10

CVE-2026-105009Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-105010Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-105013Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Microsoft Sharepoint Server High CVSS 7.4 13/10

CVE-2026-105016Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-105442IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-105443IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.NVD analysis in progress High CVSS 8.2 13/10

CVE-2026-105445An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.NVD analysis in progress Critical CVSS 9.4 13/10

CVE-2026-105591Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105592Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 7.5 13/10

CVE-2026-105593Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105595Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105596Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105597Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105598Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105599Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 7.5 13/10

CVE-2026-105714Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 7.5 13/10

CVE-2026-105715Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 7.5 13/10

CVE-2026-105716Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105717Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105718Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-105722Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-105723Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-105725Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-105727Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-105728Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-105729Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-105732Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-105733Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-105895Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 9.9 13/10

CVE-2026-105897ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.6 13/10

CVE-2026-105898ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.Adobe Coldfusion High CVSS 8.2 13/10

CVE-2026-105899ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 10 13/10

CVE-2026-105900ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe Coldfusion High CVSS 7.5 13/10

CVE-2026-105901ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-105902CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-105903ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 9.9 13/10

CVE-2026-105994ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 7.7 13/10

CVE-2026-106042An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.NVD analysis in progress Critical CVSS 9.9 13/10

CVE-2026-106043A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-106047A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.NVD analysis in progress High CVSS 7.7 13/10

CVE-2026-106089ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-106090ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-106173A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-106612ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 9.9 13/10

CVE-2026-106613ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-106614ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 7.8 13/10

CVE-2026-106615ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-106616ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.6 13/10

CVE-2026-106617ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-106618ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.8 13/10

CVE-2026-106619ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 9 13/10

CVE-2026-106620ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 9.6 13/10

CVE-2026-106621ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.Adobe Coldfusion Critical CVSS 9.1 13/10

CVE-2026-106622ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 10 13/10

CVE-2026-106623ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.Adobe Coldfusion High CVSS 7.5 13/10

CVE-2026-106624ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 10 13/10

CVE-2026-106625Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-106626Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-106627CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa High CVSS 7.5 13/10

CVE-2026-106629Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-106630Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-106634Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress High CVSS 7.7 13/10

CVE-2026-107460Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-108130Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-108131No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-108132Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-108133Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-108134Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-108135Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 High CVSS 7 13/10

CVE-2026-108136Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-108179Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1. High CVSS 7.6 13/10

CVE-2026-108184Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.NVD analysis in progress High CVSS 7.4 13/10

CVE-2026-108185Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.NVD analysis in progress High CVSS 7.4 13/10

CVE-2026-108375dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108376dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108377dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108378dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108379dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names. High CVSS 8.8 13/10

CVE-2026-108380dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it. High CVSS 8.8 13/10

CVE-2026-108381dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108382dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108383dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108384dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists. High CVSS 8.8 13/10

CVE-2026-108385dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name. High CVSS 8.8 13/10

CVE-2026-108396Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-108398Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108399Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.2 13/10

CVE-2026-108400Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108457Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-108458Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108460Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-108461Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-108463Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108464Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-108465Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-108467Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108468Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-108471Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-108956A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. High CVSS 7.3 13/10

CVE-2026-108964A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. High CVSS 7.3 13/10

CVE-2026-108965A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. High CVSS 7.3 13/10

CVE-2026-108966A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. High CVSS 7.3 13/10

CVE-2026-108967A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. High CVSS 7.3 13/10

CVE-2026-108968A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. High CVSS 7.3 13/10

CVE-2026-108969A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-108970A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-108971A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used. Critical CVSS 9.6 13/10

CVE-2026-108972A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. High CVSS 7.3 13/10

CVE-2026-108973A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. High CVSS 7.3 13/10

CVE-2026-108974A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used. High CVSS 7.3 13/10

CVE-2026-108975A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. High CVSS 7.3 13/10

CVE-2026-109108A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. Critical CVSS 9.9 13/10

CVE-2026-109109A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure. Critical CVSS 10 13/10

CVE-2026-109110A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure. Critical CVSS 10 13/10

CVE-2026-109114A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109115A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109116A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109157A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer. Critical CVSS 9.9 13/10

CVE-2026-109403A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. High CVSS 7.3 13/10

CVE-2026-109405A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. High CVSS 7.3 13/10

CVE-2026-109412An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.NVD analysis in progress Critical CVSS 9.9 13/10

CVE-2026-109428Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-109429Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-109453Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-109519A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. High CVSS 8.3 13/10

CVE-2026-109520A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way. High CVSS 8.8 13/10

CVE-2026-109521A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109522A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109523A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109525A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. High CVSS 7.3 13/10

CVE-2026-109605A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. High CVSS 7.3 13/10

CVE-2026-109606A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. High CVSS 7.3 13/10

CVE-2026-109607A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. High CVSS 7.3 13/10

CVE-2026-109620A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. High CVSS 7.3 13/10

CVE-2026-109676FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-109687Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. High CVSS 7.6 13/10

CVE-2026-109704Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109705Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critical CVSS 9.6 13/10

CVE-2026-109707Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critical CVSS 9.6 13/10

CVE-2026-109708Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critical CVSS 9.6 13/10

CVE-2026-109709Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109712Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 7.1 13/10

CVE-2026-109715Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109716Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109720JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 7.1 13/10

CVE-2026-109722JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109730Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109733JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109734Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109736Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109737Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109739Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. High CVSS 8.8 13/10

CVE-2026-109740Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critical CVSS 9.6 13/10

CVE-2026-109743Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109744Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109745Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critical CVSS 9.6 13/10

CVE-2026-109746Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. High CVSS 7.3 13/10

CVE-2026-109747Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. High CVSS 7.3 13/10

CVE-2026-109750Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Critical CVSS 9.6 13/10

CVE-2026-109753Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109754Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109755Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Critical CVSS 9.6 13/10

CVE-2026-109756Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109757Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.3 13/10

CVE-2026-109758Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-109759Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109760Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109762Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109766Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.1 13/10

CVE-2026-109778Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High CVSS 8.8 13/10

CVE-2026-109832A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-109956NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.NVD analysis in progress High CVSS 7 13/10

CVE-2026-109960Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings. High CVSS 7.7 13/10

CVE-2026-109961Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation. High CVSS 8.5 13/10

CVE-2026-109965Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials. High CVSS 7.1 13/10

CVE-2026-109967yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process. High CVSS 7.5 13/10

CVE-2026-110005The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution. High CVSS 8.8 13/10

CVE-2026-110025A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended. High CVSS 7.3 13/10

CVE-2026-110083Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-110084Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-110097Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator. High CVSS 8.1 13/10

CVE-2026-110102Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt. High CVSS 7.5 13/10

CVE-2026-110108MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys. High CVSS 8.1 13/10

CVE-2026-110111Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-110112Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-110115Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials. High CVSS 7.5 13/10

CVE-2026-110116Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution. Critical CVSS 9.1 13/10

CVE-2026-110119Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them. High CVSS 7.1 13/10

CVE-2026-110123Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients. High CVSS 7.1 13/10

CVE-2026-110124FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices. High CVSS 8.1 13/10

CVE-2026-110128fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes. High CVSS 7.5 13/10

CVE-2026-110130Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.NVD analysis in progress Critical CVSS 10 13/10

CVE-2026-110136Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110137Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110138Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.3 13/10

CVE-2026-110139Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110140Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110142Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110144Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)Google Chrome High CVSS 8.6 13/10

CVE-2026-110145Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.3 13/10

CVE-2026-110147Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110148Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome High CVSS 8.8 13/10

CVE-2026-110149Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110151Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome High CVSS 8.8 13/10

CVE-2026-110152Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110153Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110154Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110155Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110156Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)Google Chrome High CVSS 8.3 13/10

CVE-2026-110157Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110158Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.3 13/10

CVE-2026-110159Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110161Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110162Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110163Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110164Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110165Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critical CVSS 9.6 13/10

CVE-2026-110166Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110167Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110168Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110169Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110171Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110172Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome High CVSS 8.8 13/10

CVE-2026-110202Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.Roocode Roo Code High CVSS 8.8 13/10

CVE-2026-110203Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.Roocode Roo Code High CVSS 8.8 13/10

CVE-2026-110204Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.Roocode Roo Code High CVSS 8.8 13/10

CVE-2026-110205Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.Roocode Roo Code High CVSS 8.8 13/10

CVE-2026-110206Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.Roocode Roo Code High CVSS 8.8 13/10

CVE-2026-110207Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-110208Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-110211iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-110215youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-110216youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-110220Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-110233Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-110236KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.NVD analysis in progress High CVSS 7 13/10

CVE-2026-110237Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-110238Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-110247Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.NVD analysis in progress High CVSS 8.4 13/10

CVE-2026-110249A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-110255Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.NVD analysis in progress High CVSS 8.5 13/10

CVE-2026-11731An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-11732An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-12655A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration. High CVSS 8.8 13/10

CVE-2026-12656A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state. High CVSS 8.7 13/10

CVE-2026-13138Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23. High CVSS 8.6 13/10

CVE-2026-14814GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.Gitlab High CVSS 8.2 13/10

CVE-2026-16301GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.Gitlab High CVSS 8.5 13/10

CVE-2026-16753Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier. High CVSS 8.8 13/10

CVE-2026-18228HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-23705An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.NVD analysis in progress High CVSS 7.2 13/10

CVE-2026-23707An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.NVD analysis in progress High CVSS 7.2 13/10

CVE-2026-34633ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 7.7 13/10

CVE-2026-34634ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.6 13/10

CVE-2026-35001OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file. High CVSS 7 13/10

CVE-2026-37107An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component Critical CVSS 9.8 13/10

CVE-2026-44415Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-48382Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 10 13/10

CVE-2026-48383Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 10 13/10

CVE-2026-49785Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-49950Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes. Critical CVSS 9.8 13/10

CVE-2026-52394DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. Critical CVSS 9.1 13/10

CVE-2026-53418Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-53420Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.NVD analysis in progress High CVSS 8 13/10

CVE-2026-53562Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.NVD analysis in progress High CVSS 8.5 13/10

CVE-2026-53709MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2. Critical CVSS 9.8 13/10

CVE-2026-54454OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0. Critical CVSS 9.1 13/10

CVE-2026-54640OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2. High CVSS 7.6 13/10

CVE-2026-54641OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2. High CVSS 7.7 13/10

CVE-2026-55183RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7. Critical CVSS 9.6 13/10

CVE-2026-55376Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40. High CVSS 8.8 13/10

CVE-2026-55562Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119. Critical CVSS 9 13/10

CVE-2026-55601MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review. High CVSS 7.3 13/10

CVE-2026-55675The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. Critical CVSS 10 13/10

CVE-2026-55695FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b. Critical CVSS 9.1 13/10

CVE-2026-55823Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0. High CVSS 8.7 13/10

CVE-2026-58249SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-58280Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-59241A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system. High CVSS 8.8 13/10

CVE-2026-61642Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.NVD analysis in progress High CVSS 7.7 13/10

CVE-2026-61931Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-62840Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-63146Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system. Critical CVSS 9.8 13/10

CVE-2026-63149Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in. High CVSS 7.4 13/10

CVE-2026-63152Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation. High CVSS 8.1 13/10

CVE-2026-63153Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces. High CVSS 8.1 13/10

CVE-2026-63154Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges. High CVSS 8.8 13/10

CVE-2026-63158Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application. High CVSS 7.4 13/10

CVE-2026-63159Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts. High CVSS 7.4 13/10

CVE-2026-63160Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password. High CVSS 7.4 13/10

CVE-2026-63161Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in. High CVSS 8.8 13/10

CVE-2026-63162Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution. High CVSS 8.8 13/10

CVE-2026-63163Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure. High CVSS 7.5 13/10

CVE-2026-63165Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system. High CVSS 8.1 13/10

CVE-2026-63172Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation. High CVSS 7.1 13/10

CVE-2026-63174Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces. High CVSS 8.1 13/10

CVE-2026-63316A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34. High CVSS 8.7 13/10

CVE-2026-63350Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.NVD analysis in progress Critical CVSS 9.6 13/10

CVE-2026-63353Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.NVD analysis in progress Critical CVSS 9.6 13/10

CVE-2026-63354Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.NVD analysis in progress Critical CVSS 9.6 13/10

CVE-2026-65101NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-65103NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-65104NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-65110NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-65141NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-65147NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-65148NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-65149NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-65150NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-65161NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-65162NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.NVD analysis in progress Critical CVSS 10 13/10

CVE-2026-65164NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-65170NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-65172NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.NVD analysis in progress High CVSS 8.6 13/10

CVE-2026-65173NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-65180NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-65198Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades. High CVSS 8.6 13/10

CVE-2026-65674Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-67625Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.5 13/10

CVE-2026-68836Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-68883Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.5 13/10

CVE-2026-69227A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-69326Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-69354Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69363Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 High CVSS 8 13/10

CVE-2026-69370Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-69387Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-69452Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 High CVSS 7.1 13/10

CVE-2026-69454Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69471Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69521Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-69577Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69596Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69633Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69634Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-69639Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-69650Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69651Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69673Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-69705Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-69718Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-69733Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-69736Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69743Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69763Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69765Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-69766Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69783External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69789Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69795Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69798Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69802Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-69830Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-69840Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69850Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69856Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69867Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69880Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-69882Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-69883Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critical CVSS 9.8 13/10

CVE-2026-69884Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69886Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critical CVSS 9.8 13/10

CVE-2026-69898Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-69909Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69913Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.1 13/10

CVE-2026-69915Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-69916Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69918Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69923Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 High CVSS 7.8 13/10

CVE-2026-69926Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-69931Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-69934Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-69935Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-69942Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-69943Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-69945Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 High CVSS 8.8 13/10

CVE-2026-69949Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69950Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69952Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69953Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69957Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69959Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-69963Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69964Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69966Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-69970Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69976Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69977Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-69984Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69985Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-69986Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69987Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69988Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-69991Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-69992Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-69994Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-69995Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-69996Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-69997Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-69998Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70004Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70006Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70007Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70008Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70010Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70012Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70013Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.1 13/10

CVE-2026-70014Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70015Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70021Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 High CVSS 7 13/10

CVE-2026-70023Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-70024Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critical CVSS 9.8 13/10

CVE-2026-70026Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-70027Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 High CVSS 7.8 13/10

CVE-2026-70031Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70033Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70035Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70038Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.1 13/10

CVE-2026-70045Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7 13/10

CVE-2026-70048Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70049Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.NVD analysis in progress High CVSS 8 13/10

CVE-2026-70051Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70052Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70054Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70056Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70058Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70059Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70060Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70062Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-70064Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70066Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70067Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70068Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70069Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70076Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70079Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70082Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.Microsoft Windows Server 2012 High CVSS 7.5 13/10

CVE-2026-70086Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70089Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70092Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70093Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70095Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70096Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-70098Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70102Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-70103Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70104Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-70106Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70108Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70109Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70110Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70111Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 High CVSS 8.1 13/10

CVE-2026-70112Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70113Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70114Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7.8 13/10

CVE-2026-70115Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70117Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70118Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70121Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-70123Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70126Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-70127Use after free in DNS Server allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.1 13/10

CVE-2026-70131Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70132Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70133Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70134Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70136Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70138Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70139Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70140Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70142Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70143Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70144Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7 13/10

CVE-2026-70147Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-70149Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70150Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70151Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70153Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-70155Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 High CVSS 7.5 13/10

CVE-2026-70156Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70157Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-70158Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machineNVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70159Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70160Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70161Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-70163Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70164Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70167Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.Microsoft Windows Server 2022 High CVSS 8.8 13/10

CVE-2026-70168Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70169Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70172Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70174Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70175Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-70176Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70177Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70179Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70181Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70183Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70184Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70185Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70186Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70187Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-70188Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-70190Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.3 13/10

CVE-2026-70197Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-70198Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70202Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 7.5 13/10

CVE-2026-70205Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70207Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-70209Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70210Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70212Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70213Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8 13/10

CVE-2026-70215Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70218Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70220Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.Microsoft 365 Apps High CVSS 7.8 13/10

CVE-2026-70222Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70223Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70225Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70228Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70229Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-70230Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70233Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70236Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70237Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70238Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70241Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70242Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Critical CVSS 9.8 13/10

CVE-2026-70243Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 High CVSS 7 13/10

CVE-2026-70245Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70246Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-70247Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70249Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70250Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70251Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 7.5 13/10

CVE-2026-70252Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70253Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70254Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70255Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70256Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70257Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70258Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70262Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70266Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server High CVSS 8.8 13/10

CVE-2026-70267Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Microsoft Sharepoint Server High CVSS 7.2 13/10

CVE-2026-70268Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70269Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.1 13/10

CVE-2026-70271Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7 13/10

CVE-2026-70272Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-70273Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 High CVSS 7 13/10

CVE-2026-70274Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70275Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70276Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.Microsoft 365 Apps High CVSS 7 13/10

CVE-2026-70278Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70279Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-70281Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.Microsoft 365 Apps High CVSS 7.5 13/10

CVE-2026-70282Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70285Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70286Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70287Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70291Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Critical CVSS 9.8 13/10

CVE-2026-70297Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70299Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70300Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Critical CVSS 9.8 13/10

CVE-2026-70301Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70302Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-70303Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 High CVSS 7.8 13/10

CVE-2026-70343Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-70566Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-70571Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-70580Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-71385ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.4 13/10

CVE-2026-72895A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device. High CVSS 7.7 13/10

CVE-2026-72934Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-72955Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-72968Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-72969Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-73027External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-74034Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-74035Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.NVD analysis in progress High CVSS 7.2 13/10

CVE-2026-74036Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.NVD analysis in progress High CVSS 7.2 13/10

CVE-2026-74037Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.NVD analysis in progress High CVSS 7.2 13/10

CVE-2026-74040Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-74041Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.NVD analysis in progress Critical CVSS 9.1 13/10

CVE-2026-74043Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.NVD analysis in progress Critical CVSS 9 13/10

CVE-2026-74045Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-75120The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishmentNVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-75732Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.NVD analysis in progress Critical CVSS 9.9 13/10

CVE-2026-75748ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 7.6 13/10

CVE-2026-75826Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands. High CVSS 8.5 13/10

CVE-2026-75994ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critical CVSS 9.6 13/10

CVE-2026-75995ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 8.4 13/10

CVE-2026-75996ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe Coldfusion High CVSS 7.5 13/10

CVE-2026-76001ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion High CVSS 7.1 13/10

CVE-2026-77090CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.NVD analysis in progress High CVSS 8.7 13/10

CVE-2026-77093CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScaleNVD analysis in progress High CVSS 7.1 13/10

CVE-2026-77094CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-77095CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-77096CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.NVD analysis in progress High CVSS 7.7 13/10

CVE-2026-77099CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-77100MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.NVD analysis in progress High CVSS 8.7 13/10

CVE-2026-77206Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-77207Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.NVD analysis in progress Critical CVSS 9.9 13/10

CVE-2026-77496Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-77902Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps High CVSS 8.8 13/10

CVE-2026-77910Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-78459Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-78556A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.NVD analysis in progress High CVSS 7.4 13/10

CVE-2026-78557A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machineNVD analysis in progress High CVSS 8.3 13/10

CVE-2026-78799Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code. Critical CVSS 9.8 13/10

CVE-2026-78802An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. Critical CVSS 9.8 13/10

CVE-2026-79608The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.htmlNVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-79609XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-79610XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-81839GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.Gitlab High CVSS 7.7 13/10

CVE-2026-81858IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.Ibm I High CVSS 8.1 13/10

CVE-2026-81969Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-81971Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-82416FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5. High CVSS 7.7 13/10

CVE-2026-83499Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83505Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83506Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83508Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83509Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83510Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83511Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.NVD analysis in progress High CVSS 7.4 13/10

CVE-2026-83513Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83514Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83516Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83517Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83518Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83519Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83520Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83522Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-83523Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83564Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83566Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83567Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83568Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83569Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83570Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83574Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83575Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83578Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83579Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83580Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83583Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83584Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83585Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83586Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83587Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83588Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83634Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83635Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.Microsoft Windows Server 2012 High CVSS 7.5 13/10

CVE-2026-83637Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83638Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83639Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83640Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83641Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83642Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 High CVSS 8.8 13/10

CVE-2026-83643Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83644Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83645Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83647Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83650Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83652Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83654Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83655Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83659Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83661Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop High CVSS 7.8 13/10

CVE-2026-83662Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.NVD analysis in progress Critical CVSS 9.3 13/10

CVE-2026-83665Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83666Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83669Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83670Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83674Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-83675Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83676Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83677Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83678Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83679Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83680Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83682Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83687Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83688Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83689Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83690Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83691Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83692Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83693Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83694Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83696Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83698Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83699Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83700Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83701Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83702Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83704Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83707Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83708Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83709Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83710Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83712Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83715Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.NVD analysis in progress High CVSS 7.1 13/10

CVE-2026-83716Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83717Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83718Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83720Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83721Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83722Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83724Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83725Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83726Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83727Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83728Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83732Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83735Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83738Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83739Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83740Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83741Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83746Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.1 13/10

CVE-2026-83748Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83749Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83750Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83751Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83752Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83753Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83754Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83756Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 High CVSS 7.8 13/10

CVE-2026-83757Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83758Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83759Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83761Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-83762Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83763Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83767Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83768Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 High CVSS 7.8 13/10

CVE-2026-83769Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83770Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83771Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83775Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83777Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83778Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83779Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83780Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83781Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83782Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.NVD analysis in progress Critical CVSS 9.8 13/10

CVE-2026-83783Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83784Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83785Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83789Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83790Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83791Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83792Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83793Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83795Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.NVD analysis in progress High CVSS 7.5 13/10

CVE-2026-83796Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83797Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.NVD analysis in progress High CVSS 8.8 13/10

CVE-2026-83826Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83827Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7 13/10

CVE-2026-83828Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83829Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83830Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

CVE-2026-83832Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.NVD analysis in progress High CVSS 7.8 13/10

· 24044 CVEs tracked Full archive →