PT-2026-70494

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. An out-of-bounds read occurs when the software reads data past the end of the...

PT-2026-70472

Name of the Vulnerable Software and Affected Versions Windows GDI+ affected versions not specified Description The use of an uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. Recommendations At the moment, there is no information about a newer...

PT-2026-70557

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description An out-of-bounds write in Windows DNS allows an unauthorized attacker to execute arbitrary code over an adjacent network, which can affect the system. Recommendations At the moment, there...

CVE-2026-11814: Improper Certificate Validation

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic attacker-in-the-middle to compromise the confidentiality and integrity of the affected device. This issue is limited to certain...

CVE-2026-50516: Missing Authentication for Critical Function

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-54512: Uncontrolled Search Path Element

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution...

CVE-2026-62917: Improper Input Validation

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-59133: Execution with Unnecessary Privileges

Execution with unnecessary privileges in Microsoft High Performance Computing HPC Pack allows an authorized attacker to elevate privileges over a network...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

PT-2026-70762

Name of the Vulnerable Software and Affected Versions Microsoft PowerPoint affected versions not specified Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description Improper input validation in Microsoft Office PowerPoint allows...

CVE-2026-62738: Out-of-bounds Read

Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally...

CVE-2026-65806: Missing Authorization

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...

CVE-2026-65815: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

CVE-2026-70321: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-21269: Improper Neutralization of Input During Web Page Generation

ColdFusion is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

CVE-2026-62712: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-18972: Authentication Bypass by Spoofing

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

CVE-2026-54123: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...

CVE-2026-11739: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic attacker in the middle to compromise the confidentiality and integrity of the affected device...

CVE-2026-64934: Reliance on Untrusted Inputs in a Security Decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...