KLA91209 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A spoofing...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

PT-2026-70589

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description An integer overflow or wraparound occurs, allowing an unauthorized attacker to execute arbitrary code locally or remotely, which can affect the system. An integer overflow is a conditi...

PT-2026-70370

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-70656

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70638

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70391

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A heap-based buffer overflow exists in the Windows Imaging Component during the parsing of ICC files. This out-of-bounds write allows an unauthorized attacker to execute code locall...

PT-2026-70888

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete revision function in all versions up to, and including, 2.8.169. This makes it possible for...

PT-2026-70287

Exposure of sensitive information to an unauthorized actor for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable...

PT-2026-70811

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-70866

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PT-2026-70639

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70780

Name of the Vulnerable Software and Affected Versions Microsoft Azure Attestation service affected versions not specified Device Health Attestation Service affected versions not specified Description An integer overflow or wraparound occurs in the Microsoft Azure Attestation service and Device...

PT-2026-70113

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. Thi...

PT-2026-70600

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs when a...

PT-2026-70126

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

PT-2026-70314

Improper authentication for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may...

PT-2026-70363

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

PT-2026-70990

OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability...

PT-2026-70575

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A stack-based buffer overflow occurs wh...