CVE-2026-71386: Improper Neutralization of Input During Web Page Generation

is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...

CVE-2026-71383: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...

CVE-2026-61929: Use After Free

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-19425: Improper Neutralization of Special Elements used in an SQL Command

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-62737: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-62707: Use After Free

Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-61928: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally...

CVE-2026-62909: Unchecked Return Value

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

PT-2026-70081

Name of the Vulnerable Software and Affected Versions claircore affected versions not specified Description A flaw in the RPM package scanner allows a denial of service. Specifically, crafted RPM header data within a container layer can trigger an unchecked type assertion, causing the scanner to...

CVE-2026-18972: Authentication Bypass by Spoofing

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

CVE-2026-62915: Missing Authorization

Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network...

CVE-2026-62886: Integer Overflow or Wraparound

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally...

CVE-2026-48439: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-62781: Heap-based Buffer Overflow

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

CVE-2026-70322: Improper Input Validation

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally...

CVE-2026-71384: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The...

CVE-2026-19519: Reachable Assertion

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service...

CVE-2026-61936: Missing Authorization

Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally...

CVE-2026-61357: Use After Free

Use after free in Application Information Services allows an authorized attacker to elevate privileges locally...

CVE-2025-0046: Incorrect Permission Assignment for Critical Resource

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution...