vulnerabilities handled in Microsoft Developer Tools

Microsoft has identified vulnerabilities in various components of the Developer Tools, such as .NET and Visual Studio. Malicious actors can exploit these vulnerabilities, resulting in damages as described in the tables below. .NET: |------------------|------|-------------------------------------|...

Vulnerabilities in Microsoft Dynamics

Microsoft has addressed vulnerabilities in various Dynamics components. A malicious individual could exploit these vulnerabilities to execute attacks that can cause damage, as listed in the following tables: Microsoft Dataverse: | CVE-ID | CVSS | Impact | |--------|------|---------| |...

CVE-2026-110206 Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...

CVE-2026-110206

Roo-Code versions up to and including 3.54.0 are vulnerable to a command approval bypass in the parseCommandLine() function. The root cause is an interpretation conflict where attackers can use command substitution at the command position to bypass the software's allowlist. By using indirect prom...

CVE-2026-110205

Roo-Code versions through 3.54.0 are vulnerable to a command approval bypass in the parseCommandLine() function. The flaw occurs because the system discards command substitutions when they are placed adjacent to ＊ or ！ (glob characters). An attacker leveraging indirect prompt injection can craft ...

CVE-2026-110203 Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...

CVE-2026-110204

Roo Code versions through 3.54.0 are vulnerable to a command approval bypass due to how the parseCommandLine() function handles ${ command; } substitutions as parameter expansions. Attackers can utilize indirect prompt injection to embed unauthorized shell commands within allowlisted commands, su...

CVE-2026-110203

Roo-Code versions through 3.54.0 are vulnerable to a command approval bypass caused by a quote-masking regex flaw in the parseCommandLine() function. Attackers can utilize indirect prompt injection with escaped or single-quoted double quotes to conceal command separators behind allowlisted prefix...

CVE-2026-110202 Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping

Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...

CVE-2026-110202

Roo-Code versions up to and including 3.54.0 are vulnerable to a command approval bypass in the getCommandDecision() function. The root cause is redirect operator stripping , where attackers can auto-approve denied shell commands by prefixing them with a bare >& redirect. By using indirect pro...

Vulnerabilities in Microsoft Windows

Microsoft has identified 1,159 vulnerabilities in Windows. It is too complex to list every vulnerability individually. The 53 most severe vulnerabilities, with a CVSS score of 9 or higher, are listed below. These vulnerabilities give malicious actors the ability to impersonate other users, gain...

CVE-2018-16763

CVE-2018-16763 CVE-2018-16763 FuelCMS 1.4 Remote Code Execution, this version of FuelCMS is still vulnerable until now...

CVE-2009-0182

VUPlayer 2.49 Local Buffer Overflow to Arbitrary Code Execution Program Version: VUPlayer 2.49 Vulnerability: local buffer overflow when importing .wax playlist file that will lead to arbitrary code execution Exploitation: Local Buffer Overflow CVE: CVE-2009-0182 VUPlayer2.49poc.py : without bypa...

vulnerabilities present in Microsoft Office

Microsoft has fixed xxx vulnerabilities in various Office products, such as Word, Excel, Access, Outlook, Visio, SharePoint, and PowerPoint, as well as subcomponents like Shell, Azure Key Vault, and Click-to-Run. A malicious actor could exploit these vulnerabilities to cause a denial-of, gain...

CVE-2026-104340 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-104340

Adobe FrameMaker is affected by a Heap-based Buffer Overflow vulnerability (CWE-122) that could lead to arbitrary code execution within the context of the current user. Exploitation of this vulnerability requires user interaction, specifically the opening of a malicious file. Adobe has released a...

CVE-2026-103966 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-103966

Adobe Framemaker is impacted by a Heap-based Buffer Overflow (CWE-122) vulnerability. This flaw could lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction , specifically when a victim opens a malicious file. No specific affected versions,...

CVE-2026-106625 Adobe Framemaker | Out-of-bounds Write (CWE-787)

Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-106625

Adobe Framemaker is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a malicious file. No s...