EUVD-2026-10665

Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally...

EUVD-2026-10631

Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

EUVD-2026-10651

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally...

EUVD-2026-10632

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

EUVD-2026-10633

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

EUVD-2026-10652

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally...

EUVD-2026-10588

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

EUVD-2026-10589

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2026-25180

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally...

CVE-2026-25180

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally...

CVE-2026-25168

Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

CVE-2026-25169

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

CVE-2026-25169

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

CVE-2026-25168

Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

CVE-2026-23668

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2026-23668

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2026-30974 Copyparty volflag `nohtml` did not block javascript in svg files

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the...

CVE-2026-30974 Copyparty volflag `nohtml` did not block javascript in svg files

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the...

CVE-2026-30974

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the...

CVE-2026-30974

The copyparty advisory GHSA-M6HV-X64C-27MM describes a vulnerability where the nohtml volflag failed to block JavaScript in SVG files. Although not a vulnerability by itself, this allowed a user with write access to upload an SVG containing embedded JavaScript that could execute when opened, pote...