CVE-2026-56170

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-55011

CVE-2026-55011 : The vulnerability is a local code execution in Microsoft Defender caused by an integer underflow (wrap/wraparound), allowing an unauthorized attacker to run code on the affected system. The available documents consistently describe a local-execution impact from this underflow; no...

CVE-2026-55012

CVE-2026-55012 is a Microsoft Defender vulnerability described as an integer overflow/wraparound that enables local code execution. The CVSS details indicate a Local attack vector with User Interaction required, no privileges required, and impacts to Confidentiality, Integrity, and Availability (...

CVE-2026-55008

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-54122

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally...

CVE-2026-54999

The CVE-2026-54999 entry concerns a race condition in Windows TCP/IP where concurrent access to a shared resource allows an unauthorized attacker on an adjacent network to execute code. Documented impact is remote code execution with high severity (CVSSv3.1: AV=A, AC=L, PR=N, UI=N, S=U, C=H, I=H,...

CVE-2026-54999

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-54982

Integer underflow wrap or wraparound in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-54992

Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally...

CVE-2026-54990

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

CVE-2026-54990

CVE-2026-54990 describes a heap-based buffer overflow in the Remote Desktop Client that allows an unauthenticated attacker to execute code over the network. The issue is characterized as high severity (CVSS v3.1 base score 9.8, CRITICAL) with network attack vector, no privileges required, and no ...

CVE-2026-50663

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network...

CVE-2026-45496

The CVE-2026-45496 entry describes a path traversal vulnerability in Visual Studio Code where improper limitation of a pathname to a restricted directory allows local attackers to bypass a security feature. Affected component is Visual Studio Code (path handling/file access) with the root cause b...

CVE-2026-49172

The CVE-2026-49172 entry describes a heap-based buffer overflow in Windows FTP Service that allows an unauthenticated, network-based attacker to execute code remotely. Documents confirm the vulnerability exists in Windows FTP Service and enables remote code execution with network access and no re...

CVE-2026-49164

CVE-2026-49164 affects Active Directory Domain Services (AD DS). The vulnerability is described as a heap-based buffer overflow in AD DS that allows an unauthenticated, network-based attacker to execute code remotely. Public sources in the provided documents consistently label this as an executio...

CVE-2026-34349

CVE-2026-34349 describes a local information disclosure in Windows Media where sensitive data is exposed to an unauthorized actor, potentially enabling a local attacker with low privileges and no user interaction to disclose information. The report notes a CVSSv3.1 base score of 5.5 (Medium), wit...

CVE-2026-59839

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1...

CVE-2026-52839

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

BIT-PARSE-2026-57481 Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL rea...