Veille des vulnérabilités CVE

mise à jour quotidienne

Veille des vulnérabilités

identifiantvulnérabilitésévéritépublié

CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.Collabora Collabora Online – Built-in CODE Server Critique CVSS 9.2 23/10

CVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista VeloCloud Orchestrator Critique 23/10

CVE-2026-106931SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.EG Secure Solutions SiteGuard Server Edition Critique CVSS 7.8 20/10

CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens Software Center Critique 20/10

CVE-2026-96652Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server Critique 20/10

CVE-2026-96654Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server Critique 20/10

CVE-2026-96655Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server Critique 20/10

CVE-2026-96656Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.Plex Media Server Critique CVSS 7.2 20/10

CVE-2025-61624Fortinet Multiple Products Path Traversal VulnerabilityFortinet Multiple Products Critique 16/10

CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support Critique 16/10

CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.Atlassian Multiple Products Critique CVSS 7.5 15/10

CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityPalo Alto Networks PAN-OS Critique 14/10

CVE-2026-100153The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking. Élevée CVSS 7.2 14/10

CVE-2026-101924The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link. Élevée CVSS 7.2 14/10

CVE-2026-102251The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely. Élevée CVSS 7.5 14/10

CVE-2026-103307The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid. Élevée CVSS 8.6 14/10

CVE-2026-103422The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page. Élevée CVSS 7.2 14/10

CVE-2026-103423The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier. Élevée CVSS 7.5 14/10

CVE-2026-104749The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen. Élevée CVSS 7.5 14/10

CVE-2026-104767The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it. Élevée CVSS 7.5 14/10

CVE-2026-104800The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API. Critique CVSS 9.8 14/10

CVE-2026-104995The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8. Élevée CVSS 8.1 14/10

CVE-2026-105133A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.Ahsay AhsayCBS Critique CVSS 7.3 14/10

CVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.Ahsay AhsayCBS Critique CVSS 10 14/10

CVE-2026-105429Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name. Élevée CVSS 8 14/10

CVE-2026-107126The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data. Élevée CVSS 8.8 14/10

CVE-2026-107508The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file. Élevée CVSS 8.6 14/10

CVE-2026-107594The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise. Critique CVSS 10 14/10

CVE-2026-108473Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account. Élevée CVSS 8.7 14/10

CVE-2026-110002The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request. Critique CVSS 9.8 14/10

CVE-2026-110359Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges. Élevée CVSS 7.8 14/10

CVE-2026-110385A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.Analyse NVD en cours Élevée CVSS 8.7 14/10

CVE-2026-110392Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection. Critique CVSS 9.8 14/10

CVE-2026-110444TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user. Élevée CVSS 8.8 14/10

CVE-2026-110445TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user. Élevée CVSS 8.8 14/10

CVE-2026-110449Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. Élevée CVSS 7.5 14/10

CVE-2026-110450Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification. Élevée CVSS 8 14/10

CVE-2026-110455A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.Analyse NVD en cours Élevée CVSS 8.1 14/10

CVE-2026-110459A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.Analyse NVD en cours Élevée CVSS 8.6 14/10

CVE-2026-14765Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default). Élevée CVSS 7.7 14/10

CVE-2026-17092The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script. Élevée CVSS 8.1 14/10

CVE-2026-50218Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.Analyse NVD en cours Élevée CVSS 8.5 14/10

CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco Secure Email Gateway Critique 14/10

CVE-2026-77114The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it. Élevée CVSS 7.2 14/10

CVE-2026-78193The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request. Élevée CVSS 7.5 14/10

CVE-2026-82715Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A. Élevée CVSS 7.9 14/10

CVE-2026-83592The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content. Élevée CVSS 7.2 14/10

CVE-2026-87855The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Critique CVSS 9.8 14/10

CVE-2026-92097The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e. Critique CVSS 9.1 14/10

CVE-2026-92817The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.Analyse NVD en cours Élevée CVSS 8.8 14/10

CVE-2026-93388The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Critique CVSS 9.8 14/10

CVE-2026-93885The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode. Élevée CVSS 7.2 14/10

CVE-2026-94377The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation. Élevée CVSS 7.2 14/10

CVE-2026-95808The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source. Élevée CVSS 7.5 14/10

CVE-2026-95816The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads. Élevée CVSS 7.2 14/10

CVE-2026-96661The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability. Élevée CVSS 7.5 14/10

CVE-2026-97398The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached. Élevée CVSS 7.2 14/10

CVE-2026-97657The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration. Critique CVSS 9.8 14/10

CVE-2026-97668The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one. Critique CVSS 9.8 14/10

CVE-2024-34320ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. Critique CVSS 9.8 13/10

CVE-2024-34323ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request. Critique CVSS 10 13/10

CVE-2024-34324An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. Critique CVSS 9.1 13/10

CVE-2025-46773An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2025-57739An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2025-58771AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2025-58772AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.Analyse NVD en cours Élevée CVSS 8.2 13/10

CVE-2025-58773AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2025-58774AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.Analyse NVD en cours Élevée CVSS 8.3 13/10

CVE-2026-100111Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop Élevée CVSS 7.8 13/10

CVE-2026-100112Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop Élevée CVSS 7.8 13/10

CVE-2026-100113CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100114CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100115CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100117CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100118CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100119CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100120CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100121CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100122CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100123CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100124CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100127Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-100128Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-100129Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-100133Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-100135CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100136CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100137CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100138CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100139CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-100200Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7 13/10

CVE-2026-100201Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-100202Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 13/10

CVE-2026-100203Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-100205Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-100207Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-100209Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-100210Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-100211Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-100212Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-100214Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-100215Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-100216Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-100217Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-100218Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.1 13/10

CVE-2026-100219Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.Microsoft Windows 11 23h2 Critique CVSS 9.8 13/10

CVE-2026-100220Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-100222Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 13/10

CVE-2026-100225Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-101020An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges. Élevée CVSS 7.8 13/10

CVE-2026-101294IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.Analyse NVD en cours Élevée CVSS 8.7 13/10

CVE-2026-102007The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL. Élevée CVSS 7.2 13/10

CVE-2026-102073A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.Analyse NVD en cours Élevée CVSS 8.2 13/10

CVE-2026-102074A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-102075A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-102076A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-102189Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7 13/10

CVE-2026-102191Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7 13/10

CVE-2026-102192Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.Microsoft Windows Server 2019 Élevée CVSS 7.5 13/10

CVE-2026-102193Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-102194Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-102195Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7 13/10

CVE-2026-102196Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-102197Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-102201Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-102202Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-102203Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-102204Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-102205Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-102207Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-102208Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-102209Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 26h1 Élevée CVSS 7 13/10

CVE-2026-102210Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1809 Critique CVSS 9.8 13/10

CVE-2026-102211Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-102214Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-102215Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-102216Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-102217Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-102218Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-102220Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-102225Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-102226Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-102227Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-102231Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.Analyse NVD en cours Élevée CVSS 7.7 13/10

CVE-2026-102232Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-102233Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-102234Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.Analyse NVD en cours Élevée CVSS 7.4 13/10

CVE-2026-102235Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-102238Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.6 13/10

CVE-2026-102250CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device. Élevée CVSS 8.6 13/10

CVE-2026-102562The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen. Élevée CVSS 7.2 13/10

CVE-2026-102599Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-102699[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-102702[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-102849Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-102850Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-102855Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-102856Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-102857Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-102858Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.Microsoft Microsoft 365 Élevée CVSS 8.8 13/10

CVE-2026-102860Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-102861Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-102862Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-102863Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-102866Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.1 13/10

CVE-2026-102869Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-102870Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-102982Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0. Élevée CVSS 8.5 13/10

CVE-2026-102989TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-103030Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0. Élevée CVSS 7.5 13/10

CVE-2026-103296CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-103297CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-103316The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy) Élevée CVSS 7.1 13/10

CVE-2026-103418Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1. Élevée CVSS 8.8 13/10

CVE-2026-103499IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-103553Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-103554Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-103555Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-103558Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-103565Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-103568Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-103569Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-103572Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-103575Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-103577Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-103821Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Designer Élevée CVSS 7.8 13/10

CVE-2026-103830Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103832Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103833Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103834Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103835Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103836Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103837Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103838Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103839Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103840Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103841Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103842Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103843Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Substance 3d Stager Élevée CVSS 7.8 13/10

CVE-2026-103844Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-103845Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-103846Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-103847Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-103848Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 9.9 13/10

CVE-2026-103849Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 10 13/10

CVE-2026-103851Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-103854Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-103928Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-103937Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0. Élevée CVSS 8.7 13/10

CVE-2026-103966Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-103967Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-104085odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process. Élevée CVSS 8.8 13/10

CVE-2026-104192Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release. Critique CVSS 9.6 13/10

CVE-2026-104252Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.Linuxfoundation Vitess Critique CVSS 9.8 13/10

CVE-2026-104340Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-104341Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-104342Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-104344Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-104345CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-104346Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop Élevée CVSS 7.8 13/10

CVE-2026-104347Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop Élevée CVSS 7.8 13/10

CVE-2026-104348Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop Élevée CVSS 7.8 13/10

CVE-2026-104584reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions). Critique CVSS 9.8 13/10

CVE-2026-104585Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. Critique CVSS 9.8 13/10

CVE-2026-104816Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0. Élevée CVSS 8.5 13/10

CVE-2026-104817Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0. Élevée CVSS 8.7 13/10

CVE-2026-104875Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09. Élevée CVSS 7.1 13/10

CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.Ivanti Connect Secure Critique CVSS 8.6 13/10

CVE-2026-104937Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token. The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process. Élevée CVSS 8.1 13/10

CVE-2026-105003Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-105004Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-105005Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-105007An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability. The security update addresses the vulnerability by changing how ndis.sys validates buffer length.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-105008No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.Analyse NVD en cours Critique CVSS 9 13/10

CVE-2026-105009Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-105010Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-105013Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Microsoft Sharepoint Server Élevée CVSS 7.4 13/10

CVE-2026-105016Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-105442IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-105443IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.Analyse NVD en cours Élevée CVSS 8.2 13/10

CVE-2026-105445An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.Analyse NVD en cours Critique CVSS 9.4 13/10

CVE-2026-105591Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105592Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 7.5 13/10

CVE-2026-105593Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105595Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105596Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105597Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105598Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105599Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 7.5 13/10

CVE-2026-105714Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 7.5 13/10

CVE-2026-105715Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 7.5 13/10

CVE-2026-105716Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105717Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105718Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-105722Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-105723Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-105725Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-105727Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-105728Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-105729Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-105732Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-105733Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-105895Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 9.9 13/10

CVE-2026-105897ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.6 13/10

CVE-2026-105898ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.Adobe Coldfusion Élevée CVSS 8.2 13/10

CVE-2026-105899ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 10 13/10

CVE-2026-105900ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe Coldfusion Élevée CVSS 7.5 13/10

CVE-2026-105901ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-105902CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-105903ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 9.9 13/10

CVE-2026-105994ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 7.7 13/10

CVE-2026-106042An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.Analyse NVD en cours Critique CVSS 9.9 13/10

CVE-2026-106043A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-106047A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.Analyse NVD en cours Élevée CVSS 7.7 13/10

CVE-2026-106089ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-106090ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-106173A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-106612ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 9.9 13/10

CVE-2026-106613ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-106614ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 7.8 13/10

CVE-2026-106615ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-106616ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.6 13/10

CVE-2026-106617ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-106618ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.8 13/10

CVE-2026-106619ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 9 13/10

CVE-2026-106620ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 9.6 13/10

CVE-2026-106621ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.Adobe Coldfusion Critique CVSS 9.1 13/10

CVE-2026-106622ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 10 13/10

CVE-2026-106623ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.Adobe Coldfusion Élevée CVSS 7.5 13/10

CVE-2026-106624ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 10 13/10

CVE-2026-106625Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-106626Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-106627CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe C2pa Élevée CVSS 7.5 13/10

CVE-2026-106629Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-106630Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-106634Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Élevée CVSS 7.7 13/10

CVE-2026-107460Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-108130Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-108131No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-108132Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-108133Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-108134Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-108135Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 Élevée CVSS 7 13/10

CVE-2026-108136Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-108179Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1. Élevée CVSS 7.6 13/10

CVE-2026-108184Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.Analyse NVD en cours Élevée CVSS 7.4 13/10

CVE-2026-108185Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.Analyse NVD en cours Élevée CVSS 7.4 13/10

CVE-2026-108375dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108376dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108377dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108378dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108379dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names. Élevée CVSS 8.8 13/10

CVE-2026-108380dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it. Élevée CVSS 8.8 13/10

CVE-2026-108381dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108382dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108383dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108384dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists. Élevée CVSS 8.8 13/10

CVE-2026-108385dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name. Élevée CVSS 8.8 13/10

CVE-2026-108396Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-108398Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108399Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.2 13/10

CVE-2026-108400Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108457Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-108458Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108460Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-108461Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-108463Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108464Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-108465Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-108467Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108468Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-108471Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-108956A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. Élevée CVSS 7.3 13/10

CVE-2026-108964A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Élevée CVSS 7.3 13/10

CVE-2026-108965A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Élevée CVSS 7.3 13/10

CVE-2026-108966A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. Élevée CVSS 7.3 13/10

CVE-2026-108967A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Élevée CVSS 7.3 13/10

CVE-2026-108968A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Élevée CVSS 7.3 13/10

CVE-2026-108969A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-108970A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-108971A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used. Critique CVSS 9.6 13/10

CVE-2026-108972A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. Élevée CVSS 7.3 13/10

CVE-2026-108973A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Élevée CVSS 7.3 13/10

CVE-2026-108974A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used. Élevée CVSS 7.3 13/10

CVE-2026-108975A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Élevée CVSS 7.3 13/10

CVE-2026-109108A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. Critique CVSS 9.9 13/10

CVE-2026-109109A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure. Critique CVSS 10 13/10

CVE-2026-109110A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure. Critique CVSS 10 13/10

CVE-2026-109114A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109115A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109116A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109157A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer. Critique CVSS 9.9 13/10

CVE-2026-109403A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Élevée CVSS 7.3 13/10

CVE-2026-109405A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Élevée CVSS 7.3 13/10

CVE-2026-109412An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Analyse NVD en cours Critique CVSS 9.9 13/10

CVE-2026-109428Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-109429Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-109453Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-109519A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Élevée CVSS 8.3 13/10

CVE-2026-109520A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way. Élevée CVSS 8.8 13/10

CVE-2026-109521A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109522A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109523A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109525A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. Élevée CVSS 7.3 13/10

CVE-2026-109605A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Élevée CVSS 7.3 13/10

CVE-2026-109606A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. Élevée CVSS 7.3 13/10

CVE-2026-109607A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Élevée CVSS 7.3 13/10

CVE-2026-109620A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Élevée CVSS 7.3 13/10

CVE-2026-109676FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-109687Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. Élevée CVSS 7.6 13/10

CVE-2026-109704Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109705Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critique CVSS 9.6 13/10

CVE-2026-109707Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critique CVSS 9.6 13/10

CVE-2026-109708Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critique CVSS 9.6 13/10

CVE-2026-109709Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109712Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 7.1 13/10

CVE-2026-109715Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109716Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109720JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 7.1 13/10

CVE-2026-109722JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109730Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109733JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109734Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109736Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109737Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109739Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Élevée CVSS 8.8 13/10

CVE-2026-109740Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critique CVSS 9.6 13/10

CVE-2026-109743Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109744Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109745Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critique CVSS 9.6 13/10

CVE-2026-109746Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Élevée CVSS 7.3 13/10

CVE-2026-109747Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Élevée CVSS 7.3 13/10

CVE-2026-109750Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Critique CVSS 9.6 13/10

CVE-2026-109753Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109754Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109755Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Critique CVSS 9.6 13/10

CVE-2026-109756Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109757Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.3 13/10

CVE-2026-109758Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-109759Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109760Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109762Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109766Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.1 13/10

CVE-2026-109778Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Élevée CVSS 8.8 13/10

CVE-2026-109832A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-109956NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-109960Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings. Élevée CVSS 7.7 13/10

CVE-2026-109961Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation. Élevée CVSS 8.5 13/10

CVE-2026-109965Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials. Élevée CVSS 7.1 13/10

CVE-2026-109967yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process. Élevée CVSS 7.5 13/10

CVE-2026-110005The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution. Élevée CVSS 8.8 13/10

CVE-2026-110025A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended. Élevée CVSS 7.3 13/10

CVE-2026-110083Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-110084Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-110097Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator. Élevée CVSS 8.1 13/10

CVE-2026-110102Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt. Élevée CVSS 7.5 13/10

CVE-2026-110108MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys. Élevée CVSS 8.1 13/10

CVE-2026-110111Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-110112Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-110115Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials. Élevée CVSS 7.5 13/10

CVE-2026-110116Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution. Critique CVSS 9.1 13/10

CVE-2026-110119Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them. Élevée CVSS 7.1 13/10

CVE-2026-110123Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients. Élevée CVSS 7.1 13/10

CVE-2026-110124FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices. Élevée CVSS 8.1 13/10

CVE-2026-110128fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes. Élevée CVSS 7.5 13/10

CVE-2026-110130Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.Analyse NVD en cours Critique CVSS 10 13/10

CVE-2026-110136Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110137Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110138Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.3 13/10

CVE-2026-110139Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110140Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110142Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110144Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)Google Chrome Élevée CVSS 8.6 13/10

CVE-2026-110145Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.3 13/10

CVE-2026-110147Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110148Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110149Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110151Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110152Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110153Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110154Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110155Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110156Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)Google Chrome Élevée CVSS 8.3 13/10

CVE-2026-110157Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110158Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.3 13/10

CVE-2026-110159Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110161Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110162Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110163Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110164Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110165Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome Critique CVSS 9.6 13/10

CVE-2026-110166Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110167Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110168Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110169Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110171Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110172Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 13/10

CVE-2026-110202Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.Roocode Roo Code Élevée CVSS 8.8 13/10

CVE-2026-110203Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.Roocode Roo Code Élevée CVSS 8.8 13/10

CVE-2026-110204Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.Roocode Roo Code Élevée CVSS 8.8 13/10

CVE-2026-110205Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.Roocode Roo Code Élevée CVSS 8.8 13/10

CVE-2026-110206Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.Roocode Roo Code Élevée CVSS 8.8 13/10

CVE-2026-110207Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-110208Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-110211iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-110215youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-110216youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-110220Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-110233Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-110236KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-110237Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-110238Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-110247Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.Analyse NVD en cours Élevée CVSS 8.4 13/10

CVE-2026-110249A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-110255Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.Analyse NVD en cours Élevée CVSS 8.5 13/10

CVE-2026-11731An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-11732An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-12655A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration. Élevée CVSS 8.8 13/10

CVE-2026-12656A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state. Élevée CVSS 8.7 13/10

CVE-2026-13138Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23. Élevée CVSS 8.6 13/10

CVE-2026-14814GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.Gitlab Élevée CVSS 8.2 13/10

CVE-2026-16301GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.Gitlab Élevée CVSS 8.5 13/10

CVE-2026-16753Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier. Élevée CVSS 8.8 13/10

CVE-2026-18228HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-23705An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.Analyse NVD en cours Élevée CVSS 7.2 13/10

CVE-2026-23707An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.Analyse NVD en cours Élevée CVSS 7.2 13/10

CVE-2026-34633ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 7.7 13/10

CVE-2026-34634ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.6 13/10

CVE-2026-35001OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file. Élevée CVSS 7 13/10

CVE-2026-37107An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component Critique CVSS 9.8 13/10

CVE-2026-44415Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-48382Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 10 13/10

CVE-2026-48383Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 10 13/10

CVE-2026-49785Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-49950Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes. Critique CVSS 9.8 13/10

CVE-2026-52394DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. Critique CVSS 9.1 13/10

CVE-2026-53418Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-53420Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.Analyse NVD en cours Élevée CVSS 8 13/10

CVE-2026-53562Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.Analyse NVD en cours Élevée CVSS 8.5 13/10

CVE-2026-53709MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2. Critique CVSS 9.8 13/10

CVE-2026-54454OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0. Critique CVSS 9.1 13/10

CVE-2026-54640OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2. Élevée CVSS 7.6 13/10

CVE-2026-54641OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2. Élevée CVSS 7.7 13/10

CVE-2026-55183RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7. Critique CVSS 9.6 13/10

CVE-2026-55376Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40. Élevée CVSS 8.8 13/10

CVE-2026-55562Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119. Critique CVSS 9 13/10

CVE-2026-55601MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review. Élevée CVSS 7.3 13/10

CVE-2026-55675The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. Critique CVSS 10 13/10

CVE-2026-55695FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b. Critique CVSS 9.1 13/10

CVE-2026-55823Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0. Élevée CVSS 8.7 13/10

CVE-2026-58249SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-58280Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-59241A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system. Élevée CVSS 8.8 13/10

CVE-2026-61642Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.Analyse NVD en cours Élevée CVSS 7.7 13/10

CVE-2026-61931Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-62840Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-63146Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system. Critique CVSS 9.8 13/10

CVE-2026-63149Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in. Élevée CVSS 7.4 13/10

CVE-2026-63152Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation. Élevée CVSS 8.1 13/10

CVE-2026-63153Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces. Élevée CVSS 8.1 13/10

CVE-2026-63154Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges. Élevée CVSS 8.8 13/10

CVE-2026-63158Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application. Élevée CVSS 7.4 13/10

CVE-2026-63159Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts. Élevée CVSS 7.4 13/10

CVE-2026-63160Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password. Élevée CVSS 7.4 13/10

CVE-2026-63161Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in. Élevée CVSS 8.8 13/10

CVE-2026-63162Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution. Élevée CVSS 8.8 13/10

CVE-2026-63163Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure. Élevée CVSS 7.5 13/10

CVE-2026-63165Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system. Élevée CVSS 8.1 13/10

CVE-2026-63172Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation. Élevée CVSS 7.1 13/10

CVE-2026-63174Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces. Élevée CVSS 8.1 13/10

CVE-2026-63316A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34. Élevée CVSS 8.7 13/10

CVE-2026-63350Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.Analyse NVD en cours Critique CVSS 9.6 13/10

CVE-2026-63353Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.Analyse NVD en cours Critique CVSS 9.6 13/10

CVE-2026-63354Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.Analyse NVD en cours Critique CVSS 9.6 13/10

CVE-2026-65101NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-65103NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-65104NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-65110NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-65141NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-65147NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-65148NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-65149NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-65150NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-65161NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-65162NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.Analyse NVD en cours Critique CVSS 10 13/10

CVE-2026-65164NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-65170NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-65172NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.Analyse NVD en cours Élevée CVSS 8.6 13/10

CVE-2026-65173NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-65180NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-65198Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades. Élevée CVSS 8.6 13/10

CVE-2026-65674Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-67625Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.5 13/10

CVE-2026-68836Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-68883Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.5 13/10

CVE-2026-69227A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-69326Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-69354Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69363Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 Élevée CVSS 8 13/10

CVE-2026-69370Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-69387Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-69452Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 Élevée CVSS 7.1 13/10

CVE-2026-69454Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69471Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69521Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-69577Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69596Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69633Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69634Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-69639Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-69650Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69651Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69673Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-69705Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-69718Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-69733Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-69736Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69743Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69763Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69765Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-69766Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69783External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69789Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69795Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69798Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69802Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-69830Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-69840Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69850Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69856Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69867Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69880Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-69882Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-69883Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 13/10

CVE-2026-69884Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69886Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 13/10

CVE-2026-69898Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-69909Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69913Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.1 13/10

CVE-2026-69915Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-69916Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69918Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69923Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 Élevée CVSS 7.8 13/10

CVE-2026-69926Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-69931Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-69934Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-69935Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-69942Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-69943Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-69945Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 Élevée CVSS 8.8 13/10

CVE-2026-69949Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69950Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69952Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69953Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69957Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69959Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-69963Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69964Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69966Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-69970Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69976Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69977Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-69984Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69985Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-69986Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69987Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69988Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-69991Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-69992Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-69994Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-69995Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-69996Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-69997Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-69998Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70004Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70006Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70007Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70008Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70010Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70012Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70013Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.1 13/10

CVE-2026-70014Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70015Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70021Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 Élevée CVSS 7 13/10

CVE-2026-70023Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-70024Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 13/10

CVE-2026-70026Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-70027Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 Élevée CVSS 7.8 13/10

CVE-2026-70031Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70033Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70035Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70038Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.1 13/10

CVE-2026-70045Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7 13/10

CVE-2026-70048Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70049Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.Analyse NVD en cours Élevée CVSS 8 13/10

CVE-2026-70051Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70052Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70054Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70056Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70058Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70059Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70060Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70062Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-70064Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70066Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70067Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70068Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70069Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70076Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70079Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70082Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.Microsoft Windows Server 2012 Élevée CVSS 7.5 13/10

CVE-2026-70086Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70089Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70092Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70093Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70095Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70096Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-70098Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70102Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-70103Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70104Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-70106Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70108Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70109Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70110Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70111Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 Élevée CVSS 8.1 13/10

CVE-2026-70112Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70113Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70114Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7.8 13/10

CVE-2026-70115Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70117Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70118Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70121Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-70123Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70126Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-70127Use after free in DNS Server allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.1 13/10

CVE-2026-70131Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70132Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70133Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70134Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70136Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70138Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70139Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70140Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70142Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70143Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70144Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7 13/10

CVE-2026-70147Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-70149Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70150Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70151Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70153Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-70155Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1607 Élevée CVSS 7.5 13/10

CVE-2026-70156Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70157Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-70158Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machineAnalyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70159Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70160Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70161Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-70163Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70164Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70167Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.Microsoft Windows Server 2022 Élevée CVSS 8.8 13/10

CVE-2026-70168Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70169Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70172Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70174Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70175Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-70176Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70177Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70179Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70181Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70183Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70184Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70185Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70186Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70187Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-70188Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-70190Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.3 13/10

CVE-2026-70197Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-70198Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70202Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 7.5 13/10

CVE-2026-70205Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70207Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-70209Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70210Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70212Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70213Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8 13/10

CVE-2026-70215Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70218Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70220Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 13/10

CVE-2026-70222Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70223Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70225Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70228Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70229Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-70230Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70233Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70236Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70237Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70238Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70241Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70242Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Critique CVSS 9.8 13/10

CVE-2026-70243Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 23h2 Élevée CVSS 7 13/10

CVE-2026-70245Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70246Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-70247Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70249Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70250Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70251Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 7.5 13/10

CVE-2026-70252Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70253Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70254Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70255Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70256Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70257Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70258Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70262Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70266Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Microsoft Sharepoint Server Élevée CVSS 8.8 13/10

CVE-2026-70267Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Microsoft Sharepoint Server Élevée CVSS 7.2 13/10

CVE-2026-70268Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70269Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.1 13/10

CVE-2026-70271Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 13/10

CVE-2026-70272Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-70273Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 Élevée CVSS 7 13/10

CVE-2026-70274Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70275Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70276Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.Microsoft 365 Apps Élevée CVSS 7 13/10

CVE-2026-70278Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70279Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-70281Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.Microsoft 365 Apps Élevée CVSS 7.5 13/10

CVE-2026-70282Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70285Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70286Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70287Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70291Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Critique CVSS 9.8 13/10

CVE-2026-70297Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70299Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70300Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Critique CVSS 9.8 13/10

CVE-2026-70301Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70302Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-70303Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 13/10

CVE-2026-70343Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-70566Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-70571Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-70580Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-71385ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.4 13/10

CVE-2026-72895A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device. Élevée CVSS 7.7 13/10

CVE-2026-72934Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-72955Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-72968Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-72969Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-73027External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-74034Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-74035Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.Analyse NVD en cours Élevée CVSS 7.2 13/10

CVE-2026-74036Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.Analyse NVD en cours Élevée CVSS 7.2 13/10

CVE-2026-74037Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.Analyse NVD en cours Élevée CVSS 7.2 13/10

CVE-2026-74040Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-74041Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.Analyse NVD en cours Critique CVSS 9.1 13/10

CVE-2026-74043Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.Analyse NVD en cours Critique CVSS 9 13/10

CVE-2026-74045Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-75120The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishmentAnalyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-75732Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.Analyse NVD en cours Critique CVSS 9.9 13/10

CVE-2026-75748ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 7.6 13/10

CVE-2026-75826Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands. Élevée CVSS 8.5 13/10

CVE-2026-75994ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Critique CVSS 9.6 13/10

CVE-2026-75995ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 8.4 13/10

CVE-2026-75996ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.Adobe Coldfusion Élevée CVSS 7.5 13/10

CVE-2026-76001ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.Adobe Coldfusion Élevée CVSS 7.1 13/10

CVE-2026-77090CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.Analyse NVD en cours Élevée CVSS 8.7 13/10

CVE-2026-77093CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScaleAnalyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-77094CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-77095CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-77096CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.Analyse NVD en cours Élevée CVSS 7.7 13/10

CVE-2026-77099CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-77100MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.Analyse NVD en cours Élevée CVSS 8.7 13/10

CVE-2026-77206Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-77207Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.Analyse NVD en cours Critique CVSS 9.9 13/10

CVE-2026-77496Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-77902Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.Microsoft 365 Apps Élevée CVSS 8.8 13/10

CVE-2026-77910Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-78459Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-78556A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.Analyse NVD en cours Élevée CVSS 7.4 13/10

CVE-2026-78557A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machineAnalyse NVD en cours Élevée CVSS 8.3 13/10

CVE-2026-78799Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code. Critique CVSS 9.8 13/10

CVE-2026-78802An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. Critique CVSS 9.8 13/10

CVE-2026-79608The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.htmlAnalyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-79609XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-79610XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-81839GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.Gitlab Élevée CVSS 7.7 13/10

CVE-2026-81858IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.Ibm I Élevée CVSS 8.1 13/10

CVE-2026-81969Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-81971Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-82416FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5. Élevée CVSS 7.7 13/10

CVE-2026-83499Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83505Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83506Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83508Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83509Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83510Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83511Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.Analyse NVD en cours Élevée CVSS 7.4 13/10

CVE-2026-83513Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83514Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83516Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83517Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83518Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83519Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83520Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83522Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-83523Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83564Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83566Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83567Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83568Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83569Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83570Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83574Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83575Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83578Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83579Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83580Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83583Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83584Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83585Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83586Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83587Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83588Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83634Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83635Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.Microsoft Windows Server 2012 Élevée CVSS 7.5 13/10

CVE-2026-83637Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83638Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83639Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83640Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83641Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83642Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 13/10

CVE-2026-83643Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83644Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83645Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83647Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83650Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83652Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83654Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83655Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83659Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83661Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Photoshop Élevée CVSS 7.8 13/10

CVE-2026-83662Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.Analyse NVD en cours Critique CVSS 9.3 13/10

CVE-2026-83665Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83666Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83669Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83670Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83674Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-83675Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83676Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83677Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83678Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83679Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83680Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83682Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83687Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83688Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83689Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83690Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83691Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83692Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83693Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83694Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83696Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83698Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83699Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83700Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83701Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83702Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83704Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83707Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83708Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83709Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83710Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83712Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83715Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.Analyse NVD en cours Élevée CVSS 7.1 13/10

CVE-2026-83716Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83717Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83718Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83720Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83721Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83722Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83724Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83725Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83726Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83727Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83728Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83732Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83735Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83738Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83739Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83740Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83741Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83746Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.1 13/10

CVE-2026-83748Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83749Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83750Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83751Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83752Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83753Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83754Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83756Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 Élevée CVSS 7.8 13/10

CVE-2026-83757Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83758Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83759Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83761Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-83762Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83763Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83767Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83768Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 13/10

CVE-2026-83769Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83770Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83771Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83775Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83777Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83778Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83779Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83780Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83781Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83782Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 13/10

CVE-2026-83783Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83784Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83785Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83789Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83790Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83791Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83792Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83793Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83795Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.Analyse NVD en cours Élevée CVSS 7.5 13/10

CVE-2026-83796Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83797Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Élevée CVSS 8.8 13/10

CVE-2026-83826Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83827Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7 13/10

CVE-2026-83828Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83829Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83830Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

CVE-2026-83832Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.Analyse NVD en cours Élevée CVSS 7.8 13/10

· 24044 CVE suivies Archive complète →