CVE-2026-57095

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally...

CVE-2026-56649

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Network File System allows an unauthorized attacker to execute code over a network...

CVE-2026-55120

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally...

CVE-2026-50461

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally...

CVE-2026-50445

Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network...

CVE-2026-50434

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally...

CVE-2026-50419

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally...

CVE-2026-50416

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally...

CVE-2026-50415

Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized attacker to disclose information over a network...

CVE-2026-50339

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally...

CVE-2026-50304

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

CVE-2026-5040

The CVE-2026-5040 entry applies to TP-Link Deco M5 v1. The issue stems from a weak password hashing mechanism used to store user credentials. An attacker who obtains the password hash via system compromise or privileged access could perform brute-force or dictionary attacks. Practical consequence...

CVE-2026-58610

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally...

CVE-2026-50697

Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-49807

Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally...

CVE-2026-49172

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network...

CVE-2026-34349

Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally...

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-50350

CVE-2026-50350 concerns an information-disclosure vulnerability in Windows’ Trusted Runtime Interface Driver. An authenticated local attacker may disclose sensitive information due to an underlying flaw in the driver, with CVSSv3.1 metrics indicating Local attack vector, Low attack complexity, Lo...