Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. Th...

CVE-2026-66147

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...

EUVD-2026-56941

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...

CVE-2026-66147

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...

CVE-2026-66147

CVE-2026-66147 is an unauthenticated command-injection vulnerability in the SonicWall GMS Dispatcher Service for GMS 9.5.1 and earlier. The issue allows an unauthenticated remote attacker to execute commands and achieve remote code execution via specially crafted requests against the Dispatcher S...

CVE-2026-66147

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...

CVE-2026-73244 kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...

CVE-2026-73244 kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...

CVE-2026-66146

This CVE-2026-66146 entry relates to multiple Cross-Site Scripting (XSS) vulnerabilities in SonicWall GMS 9.5.1 (Build 9510.1044) and earlier. The affected component is GMS (Web UI) and the underlying issue enables a remote attacker to cause a user’s browser to execute injected JavaScript. The So...

CVE-2026-66146

Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...

CVE-2026-66146

Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...

CVE-2026-66146

Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...

EUVD-2026-56939

Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...

CVE-2026-66145

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

CVE-2026-66145

CVE-2026-66145 is an unauthenticated remote code execution vulnerability in SonicWall GMS 9.5.1 (Build 9510.1044) and earlier. The issue allows an attacker to read sensitive data and perform arbitrary file writes via a zip-slip vector, effectively enabling code execution over the network without ...

CVE-2026-66145

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

EUVD-2026-56938

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

CVE-2026-66145

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

threat-intel-toolkit

Threat Intel Toolkit A reusable, shareable bundle for defen...

vulnerabilities present in Microsoft Office

Microsoft has identified vulnerabilities in various Office products. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage as described in the following table. For successful exploitation, the malicious individual must deceive the victim into opening ...