CVE-2026-26128 Windows SMB Server Elevation of Privilege Vulnerability

...

CVE-2026-24294

CVE-2026-24294 affects Windows SMB Server. The core issue is improper authentication in the SMB component, enabling an authorized local attacker to elevate privileges. The CVE is rated high (CVSS 3.1 base 7.8) with local attack vector, low complexity, and no user interaction required, and the imp...

CVE-2026-24294 Windows SMB Server Elevation of Privilege Vulnerability

...

USN-8059-8: Linux kernel (NVIDIA) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SMB network file system; CVE-2025-22037, CVE-2025-37899...

CVE-2026-2261

Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes...

Windows SMB Server Elevation of Privilege Vulnerability

Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally...

KB5077474 - Description of the security update for SQL Server 2016 SP3 GDR: March 10, 2026

None None...

The vulnerability of the recv_done() function in the fs/smb/server/transport_rdma.c module of the SMB server support in the Linux operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the recvdone function in the fs/smb/server/transportrdma.c module of the SMB server support in the Linux operating system is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to gain unauthorized...

PT-2026-24288

Name of the Vulnerable Software and Affected Versions Windows Server 2025 Description Improper authentication in the Windows SMB Server allows an authorized attacker to elevate privileges locally. This issue involves an NTLM reflection bypass, which can enable an attacker to obtain SYSTEM...

PT-2026-51915

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the SCSI target core component. The sbc execute unmap function verifies that the Logical Block Address LBA plus the range does not exceed the device capacit...

The vulnerability of the Network Block Device Libnbd tool set relates to the implementation or modification of arguments that allow attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the tools for working with Network Block Device Libnbd is related to the implementation or modification of arguments. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2026-30925

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This...

CVE-2026-2261 blocklistd(8) socket leak

Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes...

CVE-2025-41759

CVE-2025-41759 describes a logic issue in the block-list handling where using a wildcard, i.e., "*" or "all", to block networks is silently treated as network 0, resulting in no networks being blocked. The description does not specify affected products, versions, or root cause beyond this interpr...

CVE-2025-41759

An administrator may attempt to block all networks by specifying "" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all...

CVE-2025-41759 Use of wildcard (“*” or “all”) in Block list

An administrator may attempt to block all networks by specifying "" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all...

PT-2026-36050

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.4 Wireshark versions 4.4.0 through 4.4.14 Description An infinite loop in the SMB2 protocol dissector can lead to a denial of service. Recommendations Update Wireshark versions 4.6.0 through 4.6.4 to a...

PT-2026-24030

An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered...

PT-2026-24060

Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets is reached, blocklistd becomes unable to run the helper script: a child process is forked, but this child dereferences a null pointer and crashes...

curl: Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)

Summary A heap-use-after-free occurs in smbsendopen at lib/smb.c when curl processes two SMB URLs targeting the same host. The function smbparseurlpath sets req-path as a non-owning pointer into smbc-share connection-owned memory. During connection reuse, the needle connection is freed via...