CVE-2026-47636

CVE-2026-47636: Improper neutralization of input during web page generation (XSS) in Microsoft Office SharePoint. Descriptions indicate an authorised attacker could perform spoofing over the network by exploiting input handling during page rendering. Affected product: Microsoft SharePoint Server;...

CVE-2026-47636

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-41098

Azure Stack Edge is affected by CVE-2026-41098 due to improper neutralization of input during web page generation, enabling cross-site scripting. The vulnerability is exploitable by an authorized attacker over the network to perform spoofing. The CVSS 3.1 metrics indicate a high-impact, network-e...

CVE-2026-47288

CVE-2026-47288 affects Windows Kerberos Key Distribution Center (KDC). The vulnerability is an integer overflow/wraparound in the Kerberos code, enabling an authorized attacker on an adjacent network to execute code. The CVE has a CVSSv3.1 score of 7.1 ( HIGH ) with attack vector Adjacent, high i...

CVE-2026-45656

CVE-2026-45656 involves a protection mechanism failure in Windows UEFI that allows an authorized attacker to bypass a security feature locally. The CVSSv3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.8 (HIGH). The attack is local with low complexity and requires low priv...

CVE-2026-45640

CVE-2026-45640 : Use-after-free in the Windows Bluetooth Port Driver enables a locally authenticated attacker to achieve privilege escalation. Affected: Windows Bluetooth Port Driver component. Root cause: use-after-free vulnerability as described. Impact: local privilege escalation with high imp...

CVE-2026-45605

CVE-2026-45605 is a Windows Bluetooth Service use-after-free vulnerability that allows an authorized, locally located attacker to escalate privileges. The CVSS 3.1 base score is 7.8 (High) with local attack vector, low attack complexity, and no user interaction; impact includes confidentiality, i...

CVE-2026-45503

CVE-2026-45503 is an SSRF vulnerability in Microsoft Exchange Server that could allow an authorized attacker to disclose information over a network. The provided documents cite CVSSv3.1 base metrics: 8.1 (High), with NETWORK attack vector, LOW attack complexity, Privileges Required: LOW, no user ...

CVE-2026-45501

Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network...

CVE-2026-33828

CVE-2026-33828 affects Windows Device Health Attestation (DHA). The vulnerability is a trust boundary violation in Windows Attestation that allows an authorized local attacker to elevate privileges. CVSS v3.1 base metrics indicate high impact to confidentiality, integrity, and availability with l...

CVE-2026-45479

The CVE-2026-45479 entries describe an XSS vulnerability in Microsoft Office SharePoint where improper neutralization of input during web page generation can enable an authorized attacker to perform spoofing over the network. Affected product is SharePoint/SharePoint Server; the root cause is lac...

CVE-2026-45467

CVE-2026-45467 describes an XSS vulnerability in Microsoft Office SharePoint Server caused by improper neutralization of input during web page generation. The issue can allow a network-based, authenticated attacker with low privileges to spoof content presented to users, requiring user interactio...

CVE-2026-41108

CVE-2026-41108 is a heap-based buffer overflow in the Microsoft Windows DNS Client that allows an authorized, local attacker to perform privilege escalation. Affected component: Windows DNS client functionality (DNS resolution path); root cause: heap-based overflow leading to elevation of privile...

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability

Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally...

Microsoft Office Project Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network...

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...