CVE-2026-102191: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-102206: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-102231: Improper Resolution of Path Equivalence

Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-105004: Out-of-bounds Read

Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-105007: Out-of-bounds Read

An elevation of privilege vulnerability exists in the Network Driver Interface Specification NDIS when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to...

CVE-2026-105731: Use of Uninitialized Resource

Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally...

CVE-2026-108398: Untrusted Search Path

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally...

CVE-2026-109157: Stack-based Buffer Overflow

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2026-109403: Server-Side Request Forgery (SSRF)

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-109409: Improper Neutralization of Special Elements used in a Command

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

CVE-2026-100225: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-102186: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally...

CVE-2026-102232: Incorrect Authorization

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-105006: Use After Free

Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-108462: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally...

CVE-2026-108467: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network...

CVE-2026-109149: Memory Allocation with Excessive Size Value

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-109155: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109190: Server-Side Request Forgery (SSRF)

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be...

CVE-2026-109607: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...