CVE-2026-69915

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69905

Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally...

CVE-2026-69916

Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69882

Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally...

CVE-2026-69884

Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally...

CVE-2026-69880

Access of resource using incompatible type 'type confusion' in Desktop Window Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-69763

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-69705

Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network...

CVE-2026-110234

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...

CVE-2026-110036

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

CVE-2026-108398

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally...

CVE-2026-108129

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-105010

Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-102869

Access of resource using incompatible type 'type confusion' in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-102226

Improper limitation of a pathname to a restricted directory 'path traversal' in Dynamics Business Central allows an authorized attacker to elevate privileges over a network...

CVE-2026-102233

Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-102218

Heap-based buffer overflow in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-102220

Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally...

CVE-2026-102204

Improper link resolution before file access 'link following' in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

CVE-2026-110130

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...