GHSA-28XV-PH75-77WH Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

Impact The .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by JSON.parse and contains a proto or constructor / prototype key, that key is returned as an own-enumerable property. The recursi...

CVE-2026-48252

Adobe Experience Manager is affected by CVE-2026-48252 (Missing Authentication for Critical Function, CWE-306). An attacker could bypass security measures and gain unauthorized write access without user interaction. The vulnerability has a CVSS v3.1 score of 8.6 (Network, Low attack complexity, N...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the apply function. An attacker can cause memory corruption and potentially crash the application by providing an output image with a mode that does not match the transform's declared output mode. Remediation...

EUVD-2026-44043

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-57093

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Missing Synchronization

Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...

CVE-2026-57969

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...

CVE-2026-34346

Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally...

CVE-2026-57093

CVE-2026-57093 – Windows Ancillary Function Driver for WinSock is a reported use-after-free vulnerability in the WinSock ancillary function driver that can be exploited locally to achieve privilege escalation. The issue affects the specific Windows driver handling WinSock operations; successful e...

CVE-2026-57093 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-57093 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-50462 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-50462

CVE-2026-50462 affects the Windows Ancillary Function Driver for WinSock. The disclosed issue is external control of a file name or path, enabling an authorized attacker to elevate privileges locally (local privilege escalation). CVSS v3.1 score is 7.8 (High) with Privileges: Low, User Interactio...

CVE-2026-50462 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-50312

CVE-2026-50312 is a Windows Ancillary Function Driver for WinSock use-after-free vulnerability that enables local privilege escalation when exploited. The initial description and connected sources confirm the affected component and root cause, and indicate the impact is elevation of privileges fo...

CVE-2026-50312 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-50312 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-57969

Technical details (affected versions, root cause, exploit vectors) are not publicly available in the provided documents. Monitor for updates from official sources and CVE records.

CVE-2026-49174

CVE-2026-49174 describes a vulnerability in Microsoft Windows DNS where missing authentication for a critical function could allow a locally authorized attacker to tamper with DNS behavior. The NVD entry notes a CVSS v3.1 base score of 6.1 (Medium) with a LOCAL attack vector, LOW attack complexit...