| CVE-2026-0001 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-0054 | In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0065 | In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0084 | In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0860 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel information.
This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-11573 | Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only). |
| CVE-2026-11891 | Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory.
This issue affects Valhall GPU Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r46p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-12285 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-12387 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-12611 | A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive.
This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client.
The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads. |
| CVE-2026-16025 | Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Input Data Manipulation.
This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3. |
| CVE-2026-16037 | Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering.
This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3. |
| CVE-2026-16497 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service. |
| CVE-2026-16769 | An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below. |
| CVE-2026-18090 | A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory. |
| CVE-2026-19201 | An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth limit, while the size guard is bypassed on recursive execution paths. By submitting a crafted Windows event log containing deeply nested elamAggregation headers, an attacker can exhaust the goroutine call stack, triggering an unrecoverable fatal runtime error (stack overflow) that immediately crashes the verifier application. |
| CVE-2026-22575 | An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. |
| CVE-2026-26084 | A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests. |
| CVE-2026-28572 | In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28590 | In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28593 | In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28594 | In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28596 | In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28599 | In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28620 | In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28622 | In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28624 | In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28626 | In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2026-28627 | In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28650 | In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28652 | In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28653 | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28655 | In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28656 | In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2026-28658 | In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28659 | In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28660 | In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28662 | In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28663 | In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28664 | In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28666 | In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28668 | In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28671 | In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-33391 | An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network. |
| CVE-2026-45515 | In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45519 | In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45520 | In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45521 | In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45525 | In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45527 | In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45528 | In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2026-45531 | In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-47625 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service. |
| CVE-2026-49879 | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-50093 | A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment. |
| CVE-2026-50349 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-53637 | Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class. |
| CVE-2026-53638 | Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application. |
| CVE-2026-53639 | Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services. |
| CVE-2026-54611 | InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix. |
| CVE-2026-55273 | In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55277 | In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-56172 | Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-56177 | Use after free in Windows Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-5729 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to access already freed memory.
This issue affects Valhall GPU Kernel Driver: from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r50p0 through r54p3, r55p0. |
| CVE-2026-58113 | A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint).
This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session. |
| CVE-2026-58234 | SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity. |
| CVE-2026-58240 | SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system. |
| CVE-2026-58599 | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. |
| CVE-2026-58600 | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-58611 | Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-58649 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-58820 | In multiple locations, there is a possible memory safety issue due to integer overflow. This could lead to local escalation of privilege with no additional execution privileges required. |
| CVE-2026-58822 | In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58823 | In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58839 | In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58846 | In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58848 | In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58874 | In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58941 | In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-61516 | Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device. |
| CVE-2026-61517 | Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation. |
| CVE-2026-62437 | When guests are terminated, various pieces of cleanup need carrying out.
The cleaning up of PCI devices which were assigned to guests, and the
associated removal of tracking structures for IRQs used by the devices
occurs relatively early in the process. Unfortunately after that point
the guest about to be terminated could cause its device model (DM) to
re-establish such tracking structures, by having it bind one or more IRQs
anew. While some of those tracking structures would still be cleaned up
later on, at least one would not be. |
| CVE-2026-62694 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-62697 | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
| CVE-2026-62759 | Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network. |
| CVE-2026-63523 | Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-65669 | Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-66302 | External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. |
| CVE-2026-66303 | Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network. |
| CVE-2026-66304 | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-66305 | Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-66306 | Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-66307 | Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network. |
| CVE-2026-66308 | Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network. |
| CVE-2026-67370 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-67373 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67376 | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-67378 | Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67379 | Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67380 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67381 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-67383 | Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67384 | Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67385 | Use after free in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67386 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67388 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-67389 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67390 | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67393 | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-68775 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-68776 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-68777 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-68778 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-68779 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-68824 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68825 | Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68827 | Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68828 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-68830 | Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally. |
| CVE-2026-68831 | Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. |
| CVE-2026-68832 | Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68833 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-68834 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68835 | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68837 | Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68838 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68839 | Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-68840 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68841 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68842 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally. |
| CVE-2026-68844 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally. |
| CVE-2026-68845 | Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68847 | Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68848 | Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68890 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68891 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
| CVE-2026-68892 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68894 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68895 | Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally. |
| CVE-2026-68896 | Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68897 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68898 | Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69265 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69266 | Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69267 | Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally. |
| CVE-2026-69269 | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69270 | Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69271 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69272 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69275 | Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69276 | Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69277 | Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69280 | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69281 | Use after free in Windows License Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69283 | Heap-based buffer overflow in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69284 | Heap-based buffer overflow in Windows DCOM Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69286 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally. |
| CVE-2026-69288 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
| CVE-2026-69289 | Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69290 | Stack-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69291 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69292 | Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69293 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69294 | Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
| CVE-2026-69295 | Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69296 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69297 | Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-69298 | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69299 | Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69300 | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69303 | Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally. |
| CVE-2026-69304 | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69305 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69307 | Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69308 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
| CVE-2026-69309 | Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69310 | Use after free in Windows DNS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69311 | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69312 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69313 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69314 | Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69315 | Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information locally. |
| CVE-2026-69316 | Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
| CVE-2026-69317 | Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network. |
| CVE-2026-69318 | Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally. |
| CVE-2026-69319 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69321 | Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally. |
| CVE-2026-69322 | Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69323 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69324 | Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69325 | Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69328 | Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69329 | Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69332 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69334 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69336 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69337 | Double free in Windows Registry allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69338 | Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69339 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally. |
| CVE-2026-69340 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69341 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69342 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69343 | Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
| CVE-2026-69344 | Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. |
| CVE-2026-69345 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
| CVE-2026-69346 | Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69347 | Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. |
| CVE-2026-69349 | Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. |
| CVE-2026-69350 | Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69351 | Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally. |
| CVE-2026-69352 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69353 | Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disclose information locally. |
| CVE-2026-69355 | External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-69356 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-69357 | Use after free in Windows NDIS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69358 | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
| CVE-2026-69359 | Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69371 | Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69372 | Out-of-bounds read in Windows Network File System allows an authorized attacker to deny service over a network. |
| CVE-2026-69373 | Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69374 | Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network. |
| CVE-2026-69375 | Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
| CVE-2026-69376 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
| CVE-2026-69377 | Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69378 | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69379 | Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69380 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69381 | Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2026-69382 | Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-69383 | External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69384 | Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an unauthorized attacker to deny service locally. |
| CVE-2026-69385 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69386 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69389 | Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69390 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
| CVE-2026-69391 | Stack-based buffer overflow in Windows Broker Infrastructure Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69392 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69393 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network. |
| CVE-2026-69394 | Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69395 | Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network. |
| CVE-2026-69396 | Use after free in Windows NDIS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69397 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69430 | Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69431 | Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69432 | Heap-based buffer overflow in Volume Manager Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69433 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69434 | Heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69436 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69438 | Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69439 | Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-69440 | Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69441 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69443 | Out-of-bounds read in Windows Device Health Attestation (DHA) allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-69444 | Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69445 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Compressed Folder allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69447 | Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69449 | Heap-based buffer overflow in Windows BitLocker allows an authorized attacker to execute code locally. |
| CVE-2026-69450 | Out-of-bounds read in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69451 | Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69453 | Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. |
| CVE-2026-69456 | Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69457 | Out-of-bounds read in Windows USB Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-69458 | Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69459 | Heap-based buffer overflow in Windows Power Dependency Coordinator allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69460 | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69461 | Stack-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69462 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69463 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69467 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69468 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69469 | Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-69470 | Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69472 | Use after free in Windows Devices Human Interface allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69474 | Use after free in Windows Overlay Filter allows an authorized attacker to disclose information over a network. |
| CVE-2026-69476 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69478 | Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69479 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
| CVE-2026-69490 | Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-69491 | Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69492 | Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69493 | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69494 | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69495 | Heap-based buffer overflow in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69496 | Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69497 | Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over a network. |
| CVE-2026-69499 | Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69500 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69501 | Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69503 | Stack-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69504 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
| CVE-2026-69505 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69507 | Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network. |
| CVE-2026-69508 | Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69509 | Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69522 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69524 | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69527 | Out-of-bounds read in Windows USB Mass Storage Class Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-69528 | Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69551 | Use after free in Windows DNS allows an authorized attacker to execute code over a network. |
| CVE-2026-69552 | Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network. |
| CVE-2026-69554 | Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. |
| CVE-2026-69571 | Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69572 | Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network. |
| CVE-2026-69573 | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69574 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69575 | Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69576 | Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69579 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69600 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69601 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69602 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69604 | Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69605 | Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69606 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69607 | Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69608 | Integer overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69611 | Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69612 | Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69613 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69617 | Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69618 | Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information locally. |
| CVE-2026-69619 | Out-of-bounds read in Windows exFAT File System allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69620 | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69621 | Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69623 | Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network. |
| CVE-2026-69624 | Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network. |
| CVE-2026-69625 | Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69628 | Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to execute code over a network. |
| CVE-2026-69631 | Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69637 | Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. |
| CVE-2026-69638 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
| CVE-2026-69641 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69642 | Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-69643 | Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69645 | Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69646 | Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network. |
| CVE-2026-69648 | Use after free in Windows Notification allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69649 | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69654 | Use after free in Windows Accounts Control allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69691 | Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69692 | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69693 | Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69694 | Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69710 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69711 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69712 | Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network. |
| CVE-2026-69713 | Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
| CVE-2026-69714 | Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69715 | Out-of-bounds read in Windows Direct Show allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69717 | Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69720 | Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69725 | Double free in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69727 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69729 | Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to execute code over a network. |
| CVE-2026-69730 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69731 | Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69735 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69738 | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69740 | Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69741 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
| CVE-2026-69744 | Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69757 | Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69758 | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69760 | Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69761 | Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69768 | Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69769 | Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69881 | Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69890 | Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69891 | Use after free in Windows Media allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69895 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
| CVE-2026-69896 | Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69921 | Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69929 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-70065 | Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-70296 | Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70334 | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2026-70342 | Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-70351 | Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70562 | Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70563 | Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-70564 | Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70565 | Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70567 | Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70568 | Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70569 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70572 | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70573 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70574 | Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70575 | Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network. |
| CVE-2026-70577 | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70578 | Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71328 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-71329 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-71330 | Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-71332 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71334 | Heap-based buffer overflow in Windows NFS Portmapper allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71336 | Integer overflow or wraparound in Windows Work Folder Service allows an authorized attacker to execute code over a network. |
| CVE-2026-71337 | Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71338 | Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71339 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71340 | Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71341 | Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-71345 | Out-of-bounds write in Windows Spaceport.sys allows an authorized attacker to execute code locally. |
| CVE-2026-71348 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-71349 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-71374 | Deserialization of untrusted data vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18. |
| CVE-2026-71375 | Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18. |
| CVE-2026-71376 | OS command injection vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18. |
| CVE-2026-71377 | Command Argument Injection Vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18. |
| CVE-2026-72930 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally. |
| CVE-2026-72931 | Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally. |
| CVE-2026-72932 | Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-72933 | Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72935 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72936 | Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72937 | Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-72940 | Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72941 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72942 | Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-72943 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. |
| CVE-2026-72944 | Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72945 | Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
| CVE-2026-72946 | Heap-based buffer overflow in Storage Port Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72947 | Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72948 | Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72949 | Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-72952 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally. |
| CVE-2026-72953 | Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72954 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. |
| CVE-2026-72957 | Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally. |
| CVE-2026-72958 | Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72960 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72962 | Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72963 | Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72964 | Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally. |
| CVE-2026-72965 | Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72967 | Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72978 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-72979 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72980 | Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally. |
| CVE-2026-72981 | Use after free in IP Helper allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72982 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72983 | Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72985 | Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-72986 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72987 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72988 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72989 | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-73309 | XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment. |
| CVE-2026-73310 | XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows. |
| CVE-2026-73311 | XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow. |
| CVE-2026-73312 | XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime. |
| CVE-2026-73313 | XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths. |
| CVE-2026-73314 | XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature. |
| CVE-2026-73315 | XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation. |
| CVE-2026-73316 | XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades. |
| CVE-2026-73317 | XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account. |
| CVE-2026-73318 | XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service. |
| CVE-2026-73319 | XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser. |
| CVE-2026-73320 | XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content. |
| CVE-2026-73321 | XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread. |
| CVE-2026-7476 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r49p3 through r49p5, r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r49p3 through r49p5, from r51p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r49p3 through r49p5, from r51p0 through r54p3, r55p0. |
| CVE-2026-7477 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p4, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-74859 | The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries. |
| CVE-2026-75631 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-75771 | Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-76191 | Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. |
| CVE-2026-76196 | Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must interact with a malicious webpage. Scope is changed. |
| CVE-2026-76199 | Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. |
| CVE-2026-77480 | Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-77481 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-77482 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-77483 | Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-77484 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-77485 | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77486 | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-77487 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-77488 | Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally. |
| CVE-2026-77489 | Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77491 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. |
| CVE-2026-77492 | Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-77493 | Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-77494 | Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77495 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-77498 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77499 | Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77500 | Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77501 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77502 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77503 | Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-77505 | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-77654 | Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection.
A local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.
This issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30. |
| CVE-2026-77890 | Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77891 | Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally. |
| CVE-2026-77892 | No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-77893 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77894 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77895 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77896 | Integer overflow or wraparound in Remote Desktop Client allows an unauthorized attacker to deny service over a network. |
| CVE-2026-77897 | Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77899 | Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77968 | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets. |
| CVE-2026-78439 | Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-78508 | Out-of-bounds read in Windows CD-ROM Driver allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2026-78516 | Buffer over-read in Windows Storage allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2026-78545 | The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives. |
| CVE-2026-78550 | The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console. |
| CVE-2026-78552 | The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives. |
| CVE-2026-78574 | The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer. |
| CVE-2026-78579 | The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic. |
| CVE-2026-78620 | The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem. |
| CVE-2026-78622 | The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents. |
| CVE-2026-78623 | The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database. |
| CVE-2026-78624 | The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem. |
| CVE-2026-78625 | The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process. |
| CVE-2026-78626 | The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources. |
| CVE-2026-78627 | The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation. |
| CVE-2026-78629 | The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application. |
| CVE-2026-78630 | The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges. |
| CVE-2026-78631 | The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file. |
| CVE-2026-78635 | The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior. |
| CVE-2026-78834 | A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature. |
| CVE-2026-78837 | A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. |
| CVE-2026-78838 | A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter. |
| CVE-2026-78971 | In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions. |
| CVE-2026-79569 | Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement. |
| CVE-2026-79570 | mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement. |
| CVE-2026-79571 | Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication. |
| CVE-2026-79572 | An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload. |
| CVE-2026-79573 | L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement. |
| CVE-2026-79574 | An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message. |
| CVE-2026-79575 | The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack. |
| CVE-2026-79576 | An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password. |
| CVE-2026-79577 | An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request. |
| CVE-2026-79588 | U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP. |
| CVE-2026-79602 | A guest with a PCI device assigned that has at least a BAR on the IO port
space can trigger a BUG() in Xen. |
| CVE-2026-79603 | x86 PV guests can free memory pages while still keeping a stale TLB entry
pointing to them. A TLB flush is only issued by Xen (if needed) when the
page is re-used. Since it's possible for the page to be scrubbed ahead of
the TLB flush, there's a window where a PV guest can modify an already
scrubbed page. |
| CVE-2026-79721 | Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project. |
| CVE-2026-79904 | Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-79907 | Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-79908 | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-79909 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-79910 | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-80074 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-80075 | Heap-based buffer overflow in Windows Work Folders allows an authorized attacker to elevate privileges locally. |
| CVE-2026-80077 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-80097 | Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-80159 | Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-80160 | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-80161 | Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-80162 | Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81352 | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81353 | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. |
| CVE-2026-81354 | Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-81355 | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. |
| CVE-2026-81356 | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81357 | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81376 | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81377 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. |
| CVE-2026-81378 | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81379 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81380 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81381 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81383 | Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81798 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS.
This issue affects Easy Appointments: from n/a through 4.0.2.1. |
| CVE-2026-81802 | Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions. |
| CVE-2026-81806 | Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery.
This issue affects Hide My WP Ghost: from n/a through 7.0.09. |
| CVE-2026-81955 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81963 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
| CVE-2026-81973 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81975 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81976 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81977 | Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81978 | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81979 | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81980 | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81981 | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81982 | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81983 | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81984 | Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81985 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81986 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81987 | Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81988 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-81989 | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-82052 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution. |
| CVE-2026-82053 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy. |
| CVE-2026-82054 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients. |
| CVE-2026-82055 | A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service. |
| CVE-2026-82056 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This |
| CVE-2026-82057 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate. |
| CVE-2026-82058 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices. |
| CVE-2026-82059 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients. |
| CVE-2026-82060 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors. |
| CVE-2026-82061 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required. |
| CVE-2026-82062 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data. |
| CVE-2026-82063 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash. |
| CVE-2026-82064 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate. |
| CVE-2026-82065 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service. |
| CVE-2026-82066 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output. |
| CVE-2026-82067 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability. |
| CVE-2026-82068 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability. |
| CVE-2026-82069 | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface. |
| CVE-2026-82710 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.
mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects usage_rules: from 0.1.18 before 1.2.8. |
| CVE-2026-83501 | Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally. |
| CVE-2026-83527 | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access. |
| CVE-2026-83939 | Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83940 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83941 | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-83952 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83954 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83955 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83970 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83971 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83972 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83973 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83974 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83975 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83976 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83977 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83978 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83979 | Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83990 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83992 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83995 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83996 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83997 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83998 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83999 | Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-84000 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. |
| CVE-2026-84001 | Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network. |
| CVE-2026-84003 | Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-84197 | In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are therefore disabled for every wss:// connection, and no builder option, constructor argument or environment variable lets an application turn validation back on. An attacker in a position to intercept the connection can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter or inject Ditto Protocol messages for the lifetime of the connection. The Java client, the browser/DOM JavaScript client and the HTTP transport of the Node.js client are not affected. |
| CVE-2026-84385 | A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here> |
| CVE-2026-84386 | A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via <insert attack vector here> |
| CVE-2026-84387 | A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here> |
| CVE-2026-84389 | A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here> |
| CVE-2026-84391 | A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here> |
| CVE-2026-84820 | Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions. |
| CVE-2026-84942 | Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation. |
| CVE-2026-85384 | A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger the overflow, leading to remote code execution.
Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration and network behavior, or disruption of device availability. |
| CVE-2026-85877 | Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85880 | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. |
| CVE-2026-86073 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1. |
| CVE-2026-86074 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2. |
| CVE-2026-86075 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2. |
| CVE-2026-86076 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86077 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2. |
| CVE-2026-86078 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2. |
| CVE-2026-86079 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86080 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86081 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86082 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86083 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86084 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. |
| CVE-2026-86085 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2. |
| CVE-2026-86237 | A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin(). |
| CVE-2026-86238 | A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. |
| CVE-2026-86550 | NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites. |
| CVE-2026-86670 | A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-86672 | A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-86673 | A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-86674 | A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function session_start of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-86806 | A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component. |
| CVE-2026-86808 | A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue. The name of the patch is 3b92dd64d5648f829968cf48bf67dc3113852fef. Upgrading the affected component is advised. |
| CVE-2026-86810 | A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely. Upgrading to version 1.10.0 is sufficient to resolve this issue. The patch is named 6fc91c49eebdb8bfdfeed71cb50a5d97eac70f24. It is advisable to upgrade the affected component. |
| CVE-2026-86819 | Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0. |
| CVE-2026-86840 | The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement. |
| CVE-2026-9034 | Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory.
This issue affects Bifrost GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p3; Valhall GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0. |
| CVE-2026-9040 | A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause a denial of service or disclose sensitive information.
This issue affects Bifrost GPU Kernel Driver: from r12p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r19p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0. |