CVE-2026-32202

Zero-click強制認証: 細工された .lnk が含まれるフォルダを表示すると、アイコンのレンダリング時にUNC解決がトリガーされ、被害者は攻撃者が指定したアウトバウンド接続を強制され、Net-NTLMv2資格情報が漏洩しリレーも可能になる。これはCVE-2026-21510の不完全な修正により発生した。Microsoftが追加した信頼性検証はShellExecuteExW呼び出し時起動時のみ機能したが、CControlPanelFolder::GetUIObjectOfの時点では既に被害が発生しており、これはShellExecuteの信頼性検証より前に呼び出される。...

CVE-2026-81383

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81383

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-69425

Improper link resolution before file access 'link following' in Windows NTFS allows an authorized attacker to perform tampering locally...

CVE-2026-69289

Improper link resolution before file access 'link following' in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-81383

Visual Studio Code is affected by an information disclosure vulnerability caused by the use of an incorrectly-resolved name or reference . An unauthorized network-based attacker can disclose information, with high confidentiality impact and changed scope (affecting other components). The attack r...

EUVD-2026-73851

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-73019

CVE-2026-73019 involves an improper resolution of path equivalence in the Windows URL Moniker component, allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability requires user interaction and grants low confidentiality impact with no integrity or availabili...

EUVD-2026-73754

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-73497

Improper link resolution before file access 'link following' in Windows NTFS allows an authorized attacker to perform tampering locally...

CVE-2026-69289

CVE-2026-69289 is an elevation of privilege vulnerability in Windows Setup Files Cleanup , caused by improper link resolution before file access ("link following"). An authorized local attacker with low privileges can exploit it without user interaction to gain high impact across confidentiality,...

CVE-2026-70563

CVE-2026-70563 is an improper link resolution before file access ("link following") vulnerability in Windows Shell that allows an unauthorized attacker to perform spoofing over a network . The assigned CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating h...

EUVD-2026-73064

Improper link resolution before file access 'link following' in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally...

CVE-2026-69379

CVE-2026-69379 is a link following vulnerability (improper link resolution before file access) in Windows NTFS that allows a local, authorized attacker to escalate privileges . The vulnerability is classified as HIGH severity (CVSS 3.1 base score 7.0) with high impact on confidentiality, integrit...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details CVEID:CVE-2026-49875 DESCRIPTION: Apache CXF's...

Windows URL Moniker Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...

Windows NTFS Tampering Vulnerability

Improper link resolution before file access 'link following' in Windows NTFS allows an authorized attacker to perform tampering locally...

Visual Studio Code Information Disclosure Vulnerability

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...