CVE-2026-102603: Unverified Password Change

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...

CVE-2026-104004: NULL Pointer Dereference

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...

PT-2026-112943

Name of the Vulnerable Software and Affected Versions DNS Server affected versions not specified Description An out-of-bounds read occurs in the DNS Server, which allows an authorized attacker to cause a denial-of-service condition over a network. This issue enables attackers to negatively affect...

CVE-2026-103560: Missing Authorization

Improper authorization in DNS Server allows an authorized attacker to perform tampering locally...

CVE-2026-103572: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network...

CVE-2026-103965: Improper Control of Generation of Code

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...

CVE-2026-83945: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-70066: Use After Free

Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally...

CVE-2026-97831: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-97838: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-67628: Out-of-bounds Read

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-70133: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network...

CVE-2026-101294: Missing Cryptographic Step

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature...

CVE-2026-97829: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-105009: Incorrect Default Permissions

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-97839: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-65674: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-96320: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-83665: Windows DHCP Server Denial of Service Vulnerability

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network...

PT-2026-112634

Name of the Vulnerable Software and Affected Versions DNS Server affected versions not specified Description An integer underflow wrap or wraparound occurs in the DNS Server, which allows an unauthorized remote attacker to execute arbitrary code over a network and affect the system. Recommendatio...