CVE-2026-73022: Use After Free

Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-28650: Protection Mechanism Failure

In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69362: Use After Free

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-77505: Use After Free

Use after free in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-28666: Incorrect Authorization

In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-84393: Improper Validation of Certificate with Host Mismatch

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via...

CVE-2026-81806: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

CVE-2026-69522: Heap-based Buffer Overflow

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

CVE-2026-69383: External Control of File Name or Path

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-28594: Protection Mechanism Failure

In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69323: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72966: Missing Authorization

Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...

CVE-2026-70572: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69421: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-28593: Product UI does not Warn User of Unsafe Actions

In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-81379: Not Failing Securely

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-33389: Lack of Administrator Control over Security

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-33391: Incorrect Authorization

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-28607: Unintended Proxy or Intermediary

In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28623: Missing Authorization

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...