CVE-2026-72931

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol SSTP allows an authorized attacker to deny service locally...

CVE-2026-70290

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2026-69853

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally...

CVE-2026-69827

Concurrent execution using shared resource with improper synchronization 'race condition' in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-69770

Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally...

CVE-2026-69672

Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally...

CVE-2026-69485

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

CVE-2026-69374

Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network...

CVE-2026-69358

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

CVE-2026-69349

Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network...

CVE-2026-69319

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Video Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69288

Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally...

CVE-2026-68840

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-68776

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-67648

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-67386

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-57099

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...