CVE-2026-65785

Summary of CVE-2026-65785 : The Windows DHCP Client is affected by a vulnerability described as “Uncontrolled resource consumption,” enabling an unauthenticated attacker on an adjacent network to cause a Denial of Service . The CVSS 3.1 vector indicates: Attack Vector: Adjacent , Attack Complexit...

CVE-2026-65661 Microsoft Office Remote Code Execution Vulnerability

...

CVE-2026-65657

Microsoft Office contains a use-after-free vulnerability (CVE-2026-65657) that allows a local attacker to execute code on the affected host. CVSS v3.1 base score 7.8 (HIGH), attack vector LOCAL, attack complexity LOW, privileges required NONE, user interaction REQUIRED, and impact HIGH for confid...

CVE-2026-62812 Windows DHCP Server Elevation of Privilege Vulnerability

...

CVE-2026-62695 Windows Storage Elevation of Privilege Vulnerability

...

CVE-2026-61937 Windows HTTP.sys Elevation of Privilege Vulnerability

...

CVE-2026-48387

CVE-2026-48387 affects CAI Content Credentials and is caused by an integer overflow/wraparound that can crash the application, resulting in a denial-of-service. Exploitation is possible without user interaction and requires local access (per CVSS metrics: AV:L, AC:L, PR:N, UI:N, S:U, A:H). The co...

CVE-2026-48438

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...

EUVD-2026-56542

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction...

CVE-2026-48362

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitatio...

AI Genie in the Wild

When I give talks about AI genies, I use this sort of example as a hypothetical. It's happened. The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And…. Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several wee...

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

Win32k Information Disclosure Vulnerability

Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally...

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

Microsoft Outlook Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Windows DNS Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network...

CVE-2026-72548

OpenSignLabs OpenSign (up to version 2.37.0) contains an information disclosure vulnerability in the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication/authorization checks, enabling unauthenticated remote attackers...

EUVD-2026-55971

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-5304

CVE-2026-5304 affects Axis devices via an ACAP configuration file input validation weakness. Exploitation requires the device to allow unsigned ACAP installations and user interaction to install a malicious ACAP app, potentially enabling privilege escalation (CVSS v3.1: 5.7, NETWORK, Privileges R...