KLA90986 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, read local files, spoof user interface. Below is a complete...

CVE-2026-32164: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate privileges locally...

CVE-2026-27911: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate privileges locally...

CVE-2026-32163: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate privileges locally...

PT-2026-32834

Name of the Vulnerable Software and Affected Versions Windows User Interface Core affected versions not specified Description A use after free issue in Windows User Interface Core allows an authorized attacker to elevate privileges locally. Use after free is a condition where a program continues ...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There is a resource management vulnerability in the Microsoft Windows User Interface Core. Attackers can exploit this vulnerability to gain higher privileges. The following products and versions a...

PT-2026-32773

CVE-2026-27911 Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate pr… https://t.co/1EBHUgkLHF...

Microsoft Windows 竞争条件问题漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There are vulnerabilities related to the Microsoft Windows User Interface Core. Attackers can exploit these vulnerabilities to gain higher privileges. The following products and versions are...

PT-2026-46821

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An inappropriate implementation in the Passwords component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, b...

PT-2026-32833

CVE-2026-32164 Concurrent execution using shared resource with improper synchronization 'race condition' in Windows User Interface Core allows an authorized attacker to elevate pr… https://t.co/ysmZfg3MT0...

LookalikeChecks Component Spoofing

The vulnerability of the LookalikeChecks component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to carry out spoofing attacks using a specially crafted HTML page...

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

CVE-2019-25695

A flaw was found in R. This local buffer overflow vulnerability allows a local attacker to execute arbitrary code. By injecting malicious input into the GUI Preferences language field, an attacker can trigger the overflow, leading to the execution of arbitrary commands...

CVE-2026-35565

Stored Cross-Site Scripting XSS via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in...

Arbitrary Code Injection

Overview google-adk is an Agent Development Kit Affected versions of this package are vulnerable to Arbitrary Code Injection via the the builder UI on Python OSS, Cloud Run, and GKEdue to missing authentication in the process. An attacker can execute arbitrary code on the server by uploading YAML...

Huawei EMUI和Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. An out-of-bounds write vulnerability exists in the...

CVE-2025-69627

Nitro PDF Pro for Windows version 14.41.1.4 is vulnerable to a heap use-after-free vulnerability within the this.mailDoc() JavaScript method. The issue occurs because an internal XID object is freed prematurely, yet its pointer is still accessed by UI and logging helper functions. This allows dow...

PT-2026-32579

Name of the Vulnerable Software and Affected Versions Prometheus versions 3.0 through 3.5.1 Prometheus versions 3.6.0 through 3.11.1 Description Stored cross-site scripting exists in multiple components of the Prometheus web UI, specifically within the Mantine UI and the old React UI. The issue...

PT-2026-46813

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description Insufficient validation of untrusted input in Wallet allows a remote attacker who has compromised the renderer process to perform UI spoofing using a crafted HTML page. Recommendations...

Apache Storm 安全漏洞

Apache Storm is an open-source distributed real-time computing system developed by the Apache Foundation in the United States using the concurrent programming language Clojure. Versions of Apache Storm prior to 2.8.6 contained a security vulnerability. This vulnerability stemmed from the fact tha...