CVE-2026-70019

CVE-2026-70019 is an information disclosure vulnerability in Windows Compressed Folder caused by a hard link mechanism that allows an unauthorized attacker to disclose information over a network. The vulnerability requires user interaction and no prior privileges (CVSS 3.1: 6.5 MEDIUM , C:H). CIS...

EUVD-2026-72994

Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network...

CVE-2026-69496

CVE-2026-69496 is a heap-based buffer overflow in Windows Compressed Folder that enables an unauthorized, unauthenticated attacker to achieve remote code execution over a network . Microsoft rates it CVSS 9.8 (Critical) with high impact to confidentiality, integrity, and availability. CISA's SSVC...

Windows Compressed Folder Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network...

ASP.NET Core Denial of Service Vulnerability

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

Windows Compressed Folder Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Windows Compressed Folder allows an authorized attacker to elevate privileges locally...

Windows Compressed Folder Information Disclosure Vulnerability

Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network...

PT-2026-87787

Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network...

PT-2026-87474

Name of the Vulnerable Software and Affected Versions Windows Compressed Folder affected versions not specified Description An improper limitation of a pathname to a restricted directory, known as path traversal, allows an authorized attacker to elevate privileges locally. Path traversal is a...

CVE-2026-70019: Windows Hard Link

Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network...

CVE-2026-69496: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network...

PT-2026-87518

Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network...

PT-2026-87350

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Server.IISIntegration versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.Server.IISIntegration versions 10.0.0 through 10.0.11 Microsoft.AspNetCore.Server.IISIntegration versions 9.0.0 through 9.0.19...

CVE-2026-69304

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-69445: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Windows Compressed Folder allows an authorized attacker to elevate privileges locally...

USN-8733-1: Gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

USN-8733-1 gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

CVE-2026-85786

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

CVE-2026-85786 Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

CVE-2026-85786

Amazon ion-java before 1.12.1 contains an incomplete fix for CVE-2026-75936, a memory-amplification denial-of-service vulnerability. The root cause is insufficient coverage of the GZIP auto-decompression opt-out that was introduced to address CVE-2026-75936, allowing a remote attacker to supply a...