PT-2026-40137

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-41613: Session Fixation

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network...

PT-2026-40249

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network...

PT-2026-40138

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description An issue exists in the deserialization mechanism of Microsoft Office SharePoint, where the software fails to properly handle untrusted data. This flaw allows an authorized...

CVE-2026-42838: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in output used by a downstream component 'injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-40416: User Interface (UI) Misrepresentation of Critical Information

User interface ui misrepresentation of critical information in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-41109: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in output used by a downstream component 'injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-35424: Missing Release of Memory after Effective Lifetime

Missing release of memory after effective lifetime in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...

CVE-2026-35422: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network...

CVE-2026-40405: NULL Pointer Dereference

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

CVE-2026-34350: NULL Pointer Dereference

Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network...

CVE-2026-40379: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-33821: Improper Privilege Management

Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network...

CVE-2026-40365: Insufficient Granularity of Access Control

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-42899: Loop with Unreachable Exit Condition

Loop with unreachable exit condition 'infinite loop' in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-40406: Use After Free

Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network...

CVE-2026-42823: Improper Access Control

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

CVE-2026-41103: Incorrect Implementation of Authentication Algorithm

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-35423: Out-of-bounds Read

Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network...

CVE-2026-43653

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service...