CVE-2026-69640

A security feature bypass vulnerability exists in the Windows Key Distribution Center due to incorrect authorization (CWE-863). This flaw allows an authorized attacker to bypass a security feature over a network. The vulnerability has a CVSS 3.1 base score of 5.3 (Medium) , with high confidential...

CVE-2026-88140

An out-of-bounds read vulnerability exists in the Windows Key Storage Provider . This flaw allows an authorized attacker to perform a local information disclosure by reading data outside of the intended memory boundaries. The vulnerability is assigned a CVSS 3.1 base score of 5.5 (Medium) with a ...

EUVD-2026-99659

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

EUVD-2026-99656

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network...

CVE-2026-88132

An origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network. This vulnerability is classified as an Access to Sensitive Data issue with a CVSS v3.1 score of 5.9 (Medium) . Microsoft has released updates to address this vulnerability; users ...

EUVD-2026-99381

Out-of-bounds read in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...

CVE-2026-83843

A vulnerability exists in the Windows Internet Key Exchange (IKE) Protocol caused by an out-of-bounds read (CWE-125). This flaw allows an unauthorized attacker to perform a denial of service (DoS) attack over a network. While the CVSS 3.1 score indicates a HIGH severity (7.5) with a NETWORK attac...

CVE-2026-69650

The Windows Key Distribution Center is vulnerable to an elevation of privilege flaw due to the improper verification of cryptographic signatures . This vulnerability allows an authorized attacker to achieve local privilege escalation. The CVSS 3.1 score is 7.8 (HIGH) , with a LOCAL attack vector ...

EUVD-2026-99284

Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

EUVD-2026-99255

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-110208

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

EUVD-2026-99249

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

vulnerabilities present in Microsoft Office

Microsoft has fixed xxx vulnerabilities in various Office products, such as Word, Excel, Access, Outlook, Visio, SharePoint, and PowerPoint, as well as subcomponents like Shell, Azure Key Vault, and Click-to-Run. A malicious actor could exploit these vulnerabilities to cause a denial-of, gain...

Vulnerabilities in Microsoft Azure

Microsoft has identified vulnerabilities in various Azure components, including Key Vault, DevOps, API Center, and Storage. Malicious actors could exploit these vulnerabilities to circumvent security measures, gain elevated privileges, execute arbitrary code, and access sensitive data. The...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...