CVE-2026-104252

The Vitess database clustering system is vulnerable to a reflected XSS attack in the twopczHandler located in go/vt/vttablet/tabletserver/twopcz.go (prior to versions 23.0.5 and 24.0.2 ). The root cause is the lack of HTML escaping when writing Action and dtid form values from the /twopcz HTTP de...

GnuPG: Incorrect cryptographic message parsing

A flaw in GnuPG's gpgsm component improperly handles the Cryptographic Message Syntax CMS format for AES-GCM. By accepting an authentication tag length of 4 bytes instead of the required 12 bytes, this vulnerability allows for a low-impact data integrity issue where the cryptographic validity of...

CVE-2026-83870

Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...

CVE-2026-83639

Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70261

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...

CVE-2026-70260

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...

CVE-2026-110036

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

CVE-2026-70260

The Microsoft Trace Data Helper component is vulnerable to an information disclosure flaw (CWE-497) that allows an authorized attacker to disclose sensitive system information locally. The vulnerability results from exposure to an unauthorized control sphere. The CVSS 3.1 score is 5.5 (Medium) , ...

CVE-2026-70261

The Microsoft Trace Data Helper component is affected by a vulnerability that allows an authorized attacker to disclose sensitive system information locally. This issue is categorized as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The vulnerability has a ...

CVE-2026-83870

The Windows Aggregated Data Platform Service is susceptible to an out-of-bounds read vulnerability (CWE-125). This flaw allows an authorized attacker to perform a local information disclosure , potentially exposing sensitive data. The vulnerability has a CVSS 3.1 base score of 5.5 (Medium). No sp...

CVE-2026-83639

A heap-based buffer overflow vulnerability exists in the Windows Sensor Data Service . This flaw allows an authorized attacker to achieve local privilege escalation . While the CVSS 3.1 score of 7.8 indicates a high severity, specific exploitation details or in-the-wild occurrences are not provid...

CVE-2026-83787

The Windows DHCP Server is affected by a vulnerability involving insufficient verification of data authenticity . This flaw allows an authorized attacker to perform a local security feature bypass . The vulnerability is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Cha...

Vulnerabilities in Microsoft System Center

Microsoft has identified vulnerabilities in Configuration Manager and Defender. A local malicious individual could exploit these vulnerabilities to gain elevated privileges and potentially access sensitive data. Microsoft Configuration Manager:...

CVE-2026-110036

A flaw exists in device-mapper-persistent-data where a local attacker can trigger a Denial of Service (DoS) . The vulnerability is caused by an arithmetic error in the synchronous block reading logic. By inducing a user or system tool to process crafted device metadata containing an excessively l...

CVE-2026-110036 Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

CVE-2026-110036

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

Vulnerabilities in Microsoft SQL Server

Microsoft has identified vulnerabilities in SQL Server. Malicious actors could exploit these vulnerabilities to cause a denial-of-service attack, gain excessive privileges, execute arbitrary code, and potentially access sensitive data. Microsoft has provided updates that address these...

qt: Qt XML: XML injection via improper output neutralization in QDom serialization.

A flaw was found in Qt XML. This vulnerability, categorized as improper output neutralization, allows an attacker to inject arbitrary XML Extensible Markup Language markup. This occurs because the QDom component, when serializing comments, CDATA Character Data, and processing instructions, does n...

CVE-2026-19939

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

CVE-2026-110099

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/id and hr/exportOvertime/id to downloa...