CVE-2026-69827

Concurrent execution using shared resource with improper synchronization 'race condition' in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-69770

Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally...

CVE-2026-69672

Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally...

CVE-2026-69485

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

CVE-2026-69374

Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network...

CVE-2026-69358

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

CVE-2026-69349

Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network...

CVE-2026-69319

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Video Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69288

Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally...

CVE-2026-68840

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-68776

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-67648

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-67386

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-57099

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

EUVD-2026-57222

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags...

CVE-2026-28633

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...