CVE-2026-69519

Azure Stack HCI has an observable response discrepancy vulnerability allowing an unauthenticated remote attacker to disclose sensitive information over the network. CVSS 3.1 scores it HIGH (8.6) with network attack vector and no privileges required. No patch version or exploitation details are pr...

EUVD-2026-63655

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1...

CVE-2026-64783

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packag...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-55642

In dbx-web before 0.5.51, auth_middleware in crates/dbx-web/src/auth.rs bypasses authentication when password_hash is None, which occurs on fresh deployments with DBX_PASSWORD unset. The service binds to 0.0.0.0:4224 by default, allowing unauthenticated attackers to call /api/connection/connect a...

CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

EUVD-2026-63429

Sony XAV-9500ES AVRCPBrResponseParser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

CVE-2026-55558 aiosmtplib: STARTTLS response injection

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-55558

CVE-2026-55558 affects aiosmtplib , an asynchronous SMTP client for Python's asyncio, in versions prior to 5.1.2 . The vulnerability resides in SMTPProtocol.start_tls (src/aiosmtplib/protocol.py), which consumes the server's 220 response and initiates the TLS handshake without clearing SMTPProtoc...

Microsoft Word Information Disclosure Vulnerability

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

Azure Arc Elevation of Privilege Vulnerability

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

Microsoft Fabric Elevation of Privilege Vulnerability

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

Azure Data Factory Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

Azure Virtual Machines Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

K000163004: Oracle Java vulnerability CVE-2026-47035

Security Advisory Description Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

EUVD-2026-63100

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...