CVE-2026-73070

Vim prior to version 9.2.0842 is affected by a local vulnerability in the socket server backend (src/socketserver.c). The socketserver_accept() function accepts unbounded client connections, which can cause descriptors to overflow fd_set structures (src/channel.c) and fixed-size struct pollfd arr...

CVE-2026-19161

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data...

CVE-2026-11940

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

CVE-2026-18640 Velociraptor directory traversal via the NewNotebook API

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

firefox: thunderbird: Site isolation issue in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

firefox: thunderbird: Site isolation issue in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

firefox: thunderbird: Site isolation issue in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

Windows Key Guard Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally...

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally...

Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...

Windows NTFS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally...

Windows Telephony Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...

Windows Device Association Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

Microsoft COM for Windows Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

Microsoft Office Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an authorized attacker to elevate privileges locally...

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network...