Windows Kerberos Elevation of Privilege Vulnerability

Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally...

Windows Graphics Kernel Elevation of Privilege Vulnerability

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...

Windows HTTP Protocol Stack Tampering Vulnerability

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network...

Win32k Information Disclosure Vulnerability

Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally...

Windows Message Queuing Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally...

Windows Storage Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

Windows DWM Core Library Information Disclosure Vulnerability

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally...

Windows Defender Firewall Service Security Feature Bypass Vulnerability

Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally...

Windows Encrypting File System (EFS) Information Disclosure Vulnerability

Out-of-bounds read in Windows Encrypting File System EFS allows an authorized attacker to disclose information locally...

Visual Studio Code Remote Code Execution Vulnerability

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...

Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally...

MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability

CVE-2026-6727 is an Information Disclosure vulnerability in the TPM 2.0 reference implementation involving an RSA OAEP timing side channel. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability...

Windows User Profile Service Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows User Profile Service allows an authorized attacker to elevate privileges locally...

.NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-68298

A flaw was found in the Linux kernel's drm/xe/vm module. During the creation of a virtual machine VM, an error in resource allocation could lead to a Shared Virtual Memory SVM resource leak. This occurs because the kernel's resource deallocation functions are not consistently called when an error...

MINI-M3Q2-242R-QC68

Bulletin has no description...

CVE-2026-68427

A flaw was found in the gpu: host1x component of the Linux kernel. The host1xbounpin function incorrectly dereferences a memory mapping after it has been freed, leading to a use-after-free vulnerability. This issue could allow a local attacker to cause memory corruption, potentially leading to a...

SonicWall Email Security Affected By Multiple Vulnerabilities

1 CVE-2026-66149 - Improper Control of Generation of Code 'Code Injection' Vulnerability via netmaskImproper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restrict...

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-58115

A vulnerability has been identified in SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions V4.3.4.1 running Industrial OS with Node-RED installed. Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are...