CVE-2026-83568

Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2026-70267

Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-70217

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-70137

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

CVE-2026-70096

Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network...

CVE-2026-70093

Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

CVE-2026-70084

Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally...

CVE-2026-110226

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary idhotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign...

CVE-2026-110229

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-105733

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

UBUNTU-CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-102860

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

EUVD-2026-100463

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

EUVD-2026-100357

Improper access control in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-96237

The .NET framework is affected by a vulnerability involving the inclusion of functionality from untrusted control sphere (CWE-829). An unauthorized attacker can exploit this to execute arbitrary code over a network. The vulnerability has a CVSS v3.1 score of 7.5 (High) and requires user interacti...

CVE-2026-96237

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

CVE-2026-70217

A vulnerability in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network due to improper access control (CWE-284). The impact is classified as access to sensitive data with a CVSSv3.1 base score of 4.9 . Microsoft has released updates to address this vul...