Microsoft Windows: CVE-2026-96926: Role: DNS Server Tampering Vulnerability

Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...

Microsoft Windows: CVE-2026-83722: Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Use after free in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

PT-2026-112979

Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

Microsoft SQL Server: CVE-2026-85919: Microsoft SQL Server Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-97825: Role: DNS Server Information Disclosure Vulnerability

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

PT-2026-113264

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-100222: Heap-based Buffer Overflow

Heap-based buffer overflow in Network Policy Server NPS allows an unauthorized attacker to execute code over a network...

CVE-2026-103560: Missing Authorization

Improper authorization in DNS Server allows an authorized attacker to perform tampering locally...

CVE-2026-105009: Incorrect Default Permissions

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-108128: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-88127: Use After Free

Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally...

CVE-2026-88115: Out-of-bounds Read

Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network...

CVE-2026-14909: Generation of Error Message Containing Sensitive Information

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled...

CVE-2026-14532: Integer Overflow or Wraparound

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception...

CVE-2026-11713: Incorrect Authorization

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled...

CVE-2026-102603: Unverified Password Change

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...

CVE-2026-103499: Uncontrolled Resource Consumption

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-109954: Concurrent Execution using Shared Resource with Improper Synchronization

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...

CVE-2026-110100: Missing Authorization

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders an...

CVE-2026-102989: Improper Neutralization of Input During Web Page Generation

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...