EUVD-2026-73442

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally...

CVE-2026-70342

CVE-2026-70342 affects the Windows Ancillary Function Driver for WinSock (AFD). The vulnerability is a use after free flaw that allows an unauthorized attacker to elevate privileges over a network. The CVSS 3.1 score is 8.1 (HIGH) , with a vector of network-based, high complexity, no privileges r...

EUVD-2026-73076

Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-73019

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...

CVE-2026-69554

CVE-2026-69554 is a missing authentication vulnerability in the Microsoft Windows Search Component , allowing a local, low-privilege attacker to perform tampering with high integrity impact (CVSS v3.1: 5.5 MEDIUM , AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No confidentiality or availability impact is...

EUVD-2026-73010

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-69415

Windows DHCP Server contains a missing authentication for critical function vulnerability that allows an authorized attacker (high privileges required) to elevate privileges over a network . The CVSS 3.1 score is 6.8 (MEDIUM) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, indicating that user i...

CVE-2026-50349

A race condition (concurrent execution using a shared resource with improper synchronization) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker with low privileges to escalate privileges locally. The vulnerability is rated CVSS 3.1 7.0 (HIGH) with high impact on c...

CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

Windows Power Dependency Coordinator Tampering Vulnerability

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally...

Azure AI Language Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

Microsoft Windows Search Component Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...

Windows Shell Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

CVE-2026-2520

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a missing capability check on the updateAddon function in all versions up to and including 27.2 . Authenticated attackers with Subscriber-level access or higher can trigger an update of any plugin whose ...

CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

EUVD-2026-72701

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...