CVE-2026-108466

An out-of-bounds read vulnerability exists in the Windows Kernel . This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability is associated with CWE-125 and has a CVSS 3.1 base score of 5.3 (Medium), where the attack complexity is high and user intera...

CVE-2026-61931

A use after free vulnerability exists in the Windows Perception Simulation Service . This flaw allows an authorized attacker to achieve local privilege escalation . While the specific component or root cause is not detailed beyond the memory corruption type, the impact includes potential high con...

CVE-2026-72968

A use after free vulnerability exists in the Windows Program Compatibility Assistant Service . This flaw allows an authorized attacker to perform a local privilege escalation . Exploitation details are not provided in the documentation, but the vulnerability is associated with CWE-416 .

CVE-2026-105722

A Use after free vulnerability exists in the Windows Broadcast DVR User Service . This flaw allows an authorized attacker to achieve local privilege escalation . The official CVSS 3.1 score is 7.0, reflecting a high severity with significant impacts on confidentiality, integrity, and availability...

CVE-2026-96183

A vulnerability exists in the Windows Health and Optimized Experiences Service due to missing authentication for a critical function. This flaw allows an authorized attacker to perform a local information disclosure . The vulnerability is assigned CWE-306 and has an official fix available. No spe...

vulnerabilities handled in Microsoft Developer Tools

Microsoft has identified vulnerabilities in various components of the Developer Tools, such as .NET and Visual Studio. Malicious actors can exploit these vulnerabilities, resulting in damages as described in the tables below. .NET: |------------------|------|-------------------------------------|...

CVE-2026-110223 Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint

Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresse...

CVE-2026-110036

A flaw exists in device-mapper-persistent-data where a local attacker can trigger a Denial of Service (DoS) . The vulnerability is caused by an arithmetic error in the synchronous block reading logic. By inducing a user or system tool to process crafted device metadata containing an excessively l...

CVE-2026-110036

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

CVE-2026-110249

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread...

CVE-2026-95502

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

CVE-2026-103937 Misskey: Denial of service resulting from insufficient cleanup processing during file uploads

Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled...

CVE-2026-103937

The open-source social media platform Misskey is vulnerable to a Denial of Service (DoS) condition due to insufficient cleanup processing during file uploads. The root cause involves a failure to properly execute cleanup tasks, which can lead to the exhaustion of storage or file descriptors when ...

tftp security update

An update is available for tftp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Trivial File Transfer Protocol TFTP is typically used only for booting...

CVE-2026-104343

Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability (CWE-476) that can result in an application denial-of-service . An attacker can exploit this issue to crash the application, but it requires user interaction where a victim must open a malicious file . No specific exploit de...

Vulnerabilities in Microsoft SQL Server

Microsoft has identified vulnerabilities in SQL Server. Malicious actors could exploit these vulnerabilities to cause a denial-of-service attack, gain excessive privileges, execute arbitrary code, and potentially access sensitive data. Microsoft has provided updates that address these...

CVE-2026-54086 SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing...

CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...