Microsoft Windows: CVE-2026-81969: Windows Server Update Service Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70076: Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-69947: Windows Overlay Filter Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack...

CVE-2026-110237: Unverified Ownership

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-100225: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-18318: Improper Restriction of Excessive Authentication Attempts

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...

CVE-2026-63161: Session Fixation

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-83870: Out-of-bounds Read

Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...

CVE-2026-83859: Use After Free

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-83845: Authentication Bypass by Spoofing

Improper privilege management in Windows Internet wininet.dll allows an authorized attacker to perform spoofing locally...

CVE-2026-83747: Out-of-bounds Read

Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally...

CVE-2026-69931: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-96217: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-70165: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-85830: Out-of-bounds Read

Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally...

CVE-2026-85374: Out-of-bounds Read

Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally...

CVE-2026-83854: Missing Authentication for Critical Function

Improper access control in Windows Notification allows an authorized attacker to disclose information locally...

CVE-2026-83654: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-70138: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally...

CVE-2026-70079: Improper Enforcement of Behavioral Workflow

Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network...