.NET 10.0 Update - January 13, 2026

None None...

Microsoft Office 代码问题漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and others. A code issue vulnerability exists in Microsoft Office. An attacker exploiting this...

PT-2026-2745

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An out-of-bounds read issue exists in Microsoft Office Word, potentially allowing an unauthorized attacker to execute code locally. Recommendations At the moment, there is no...

KLA90838 Multiple vulnerabilities in Microsoft Product (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code, obtain sensitive information, cause denial of service, spoof user interface. Below is a...

PT-2026-2749

CVE-2026-20949 Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. https://t.co/ASZWOprilb...

Microsoft Excel 缓冲区错误漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA. A buffer error vulnerability exists in Microsoft Excel. An attacker exploiting this vulnerability could remotely execute code. The following products and editions are affected:Microsoft Office...

PT-2026-2754

CVE-2026-20955 Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. https://t.co/woPteDG0yH...

PT-2026-2756

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An integer underflow condition exists in Microsoft Office Excel that could allow an unauthorized attacker to execute code locally. The issue is due to an integer underflow, als...

PT-2026-2658

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to February 2026 Patch Tuesday updates Description A vulnerability exists in the Desktop Window Manager component of Microsoft Windows that can lead to the disclosure of sensitive information to an unauthorized...

Microsoft Azure 代码问题漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A code issue vulnerability exists in Microsoft Azure. An attacker exploiting this vulnerability could remotely execute code...

Microsoft Windows SMB Server 竞争条件问题漏洞

Microsoft Windows SMB Server is a network file-sharing protocol from Microsoft. It allows applications on a computer to read and write files and request services from server programs on a computer network. An elevation of privilege vulnerability exists in Microsoft Windows SMB Server due to...

PT-2026-2758

CVE-2026-20959 Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing … https://t.co/MJ9l4ETY51...

KLA90842 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, spoof user interface, obtain sensitive information, gain privileges. Below is a complete list of vulnerabilities: 1. A remote code...

Security Updates for Microsoft Office Products (January 2026) (macOS)

The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the january-13-2026 advisory. - Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2026-20952, CVE-2026-20953 - Integer...

Russian BlueDelta (Fancy Bear) Uses PDFs to Steal Logins in Just 2 Seconds

New research from Recorded Future reveals how Russian state hackers BlueDelta are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims...

Exploit for Improper Authentication in Microsoft

CVE-2025-549...

A week in security (January 5 – January 11)

Last week on Malwarebytes Labs: pcTattletale founder pleads guilty as US cracks down on stalkerware Are we ready for ChatGPT Health? CISA warns of active attacks on HPE OneView and legacy PowerPoint Lego’s Smart Bricks explained: what they do, and what they don’t Fake WinRAR downloads hide malwar...

Exploit for Use of Uninitialized Resource in Microsoft

CVE-2025-...

CVE-2009-4444

Microsoft Internet Information Services IIS 5.x and 6.x uses only the portion of a filename before a ; semicolon character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a 1 .asp, 2...

CVE-2003-1582

Microsoft Internet Information Services IIS 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inver...