CVE-2026-58635

CVE-2026-58635 is a Windows Narrator Braille elevation-of-privilege vulnerability caused by improper neutralization of special elements used in a command. Exploitation is local, requires low privileges, and does not require user interaction; successful exploitation yields high impact to confident...

CVE-2026-58631

CVE-2026-58631 involves Windows Admin Center where improper authorization allows an authorized attacker to execute code locally. The available sources describe a local attack vector with high impact (C:H/I:H/A:H) and a CVSS v3.1 base score of 7.8, indicating remote code execution risk within the ...

CVE-2026-58618

CVE-2026-58618 : Heap-based buffer overflow in Microsoft Office Excel can allow a local attacker to execute code. Affects Excel components implicated in the heap overflow; CVSS 3.1 base score 7.8 (High). Exploitation is local and requires user interaction. Current connected docs reference Microso...

CVE-2026-58610

CVE-2026-58610: A heap-based buffer overflow in Microsoft Windows Media Foundation is described as allowing an unauthorized attacker to execute code locally. The NVD entry confirms the vulnerability and impact (local code execution) with a CVSS 3.1 base score of 7.8 (HIGH) and a local attack vect...

CVE-2026-58614

An out-of-bounds read in the Windows Kernel allows an authorized, local attacker to bypass a security feature. The CVE-2026-58614 entry notes a local vector with Privileges Required: Low and no user interaction, Confidentiality Impact: High, Impact on Availability/Integrity: none, giving a CVSS v...

CVE-2026-58609

The CVE-2026-58609 entry describes an Out-of-bounds read in the Microsoft Graphics Component that enables local execution of code by an unauthenticated attacker with user interaction. The vulnerability is linked to a local attack vector with high impact to confidentiality, integrity, and availabi...

CVE-2026-58602

CVE-2026-58602 is a Windows kernel-mode-driver vulnerability described as a use-after-free that enables an authorized, local attacker to achieve elevation of privilege. The public documents do not provide product/vendor specifics beyond “Windows kernel” and “kernel-mode driver,” nor details on af...

CVE-2026-58608

CVE-2026-58608 affects Windows Print Spooler components, where a race condition from improper synchronization on a shared resource enables remote code execution over a network. The vulnerability allows an authenticated attacker with low privileges to execute code with high impact (C/H; I/H; A/H) ...

CVE-2026-58601

CVE-2026-58601 describes a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized, local attacker to elevate privileges. The available description specifies a local-privelege-escalation impact, but does not provide product/version specifics, exploitati...

CVE-2026-58595

CVE-2026-58595 concerns the Microsoft Bing App for iOS, where an improper restriction of rendered UI layers or frames enables an unauthorized attacker to spoof over a network. The vulnerability affects the Bing iOS app’s UI rendering stack (specific component not detailed in the provided document...

CVE-2026-50522

CVE-2026-50522 is a deserialization flaw in Microsoft Office SharePoint that enables remote code execution over a network. Affected products include on‑premises SharePoint Server variants (Server 2016/2019, Subscription Edition, Enterprise Server). The root cause is deserialization of untrusted d...

CVE-2026-58526

Technical details (affected product/component/root cause/versions/exploit info) are not publicly available in the provided documents. Monitor updates from NVD/CVE records and vendor advisories for any forthcoming specifics.

CVE-2026-58279

CVE-2026-58279 affects Azure CycleCloud. The issue is missing authorization that could allow an authorized attacker to elevate privileges over a network, with integrity impact high and CVSS v3.1 base score 6.5. The attack vector is network; privileges required are low and user interaction is none...

CVE-2026-55014

CVE-2026-55014 concerns Windows Remote Help Defense with an improper access control vulnerability that lets an authorized attacker locally elevate privileges. Documented CVSSv3.1: 7.8 (HIGH) — LOCAL, LOW complexity, LOW privileges required, NONE user interaction; impact to confidentiality, integr...

CVE-2026-57976

The CVE-2026-57976 entry concerns Windows Active Directory Domain Services and is triggered by a null pointer dereference that can cause a denial of service over the network by an authorized attacker. The NVD entry corroborates a CVSS v3.1 base score of 6.5 (Medium), with NETWORK attack vector, L...

CVE-2026-57979

CVE-2026-57979 describes an out-of-bounds read in Windows Remote Desktop Protocol (RDP) that could allow an unauthenticated or network-attached attacker to disclose information over the network. Publicly referenced sources (NVD, MSRC updates, ENISA EUVD, and security advisories) corroborate an in...

CVE-2026-57107

Summary: CVE-2026-57107 is an elevation-of-privilege flaw due to improper authentication in Windows Admin Center. An authorized local attacker can escalate privileges. The CVSS v3.1 base score is 7.8 (HIGH), with local attack vector, low complexity, and high impacts on confidentiality, integrity,...

CVE-2026-57969

Technical details (affected versions, root cause, exploit vectors) are not publicly available in the provided documents. Monitor for updates from official sources and CVE records.

CVE-2026-57097

CVE-2026-57097 describes an Untrusted search path in Microsoft XML that allows a physical attacker to bypass a security feature. Affects Microsoft XML; impact is described as high for confidentiality, integrity, and availability with a physical attack requiring no user interaction. No exploit det...

CVE-2026-56185

CVE-2026-56185 describes an information-disclosure issue in Windows Admin Center caused by improper authentication. The documented impact is that an authorized attacker can disclose information over a network, with a CVSS 3.1 base score of 6.5 (Network attack vector, Low attack complexity, Low pr...

CVE-2026-56193

CVE-2026-56193 describes an out-of-bounds read in Microsoft Office that allows a local attacker to disclose information. The available records indicate a high-severity impact (Confidentiality and Availability) with local access and user interaction required, but no explicit details on affected Of...

CVE-2026-50694

CVE-2026-50694 is a Windows SSTP use-after-free vulnerability that could allow an unauthenticated attacker to execute code remotely over the network. The issue affects Windows Secure Socket Tunneling Protocol (SSTP) and is rated high/critical in external assessments, with exploitation possible wi...

CVE-2026-54127

CVE-2026-54127 describes a use-after-free vulnerability in Windows Hyper-V that enables a local elevation of privileges. The CVSS 3.1 vector indicates a local attack, high impact on confidentiality, integrity, and availability, with no user interaction required and no privileges needed. The conne...

CVE-2026-56170

CVE-2026-56170 concerns ASP.NET Core where resources are allocated without limits or throttling, enabling a network-based DoS from an unauthenticated attacker. The NVD entry attributes a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no privileges required, ...

CVE-2026-56164

CVE-2026-56164 is a Microsoft SharePoint Server elevation-of-privilege vulnerability described as missing authentication for a critical function, enabling a remote attacker to elevate privileges over a network. Public advisories indicate widespread Office-related vulnerabilities, with SharePoint ...

CVE-2026-56169

CVE-2026-56169 concerns improper authentication in Windows Admin Center that can allow an attacker authenticated on the network to elevate privileges. The CVSS 3.1 base score is 8.1 (High), with network as the attack vector, low attack complexity, and low privileges required; confidentiality and ...

CVE-2026-56155

CVE-2026-56155 affects Active Directory Federation Services (AD FS) with insufficient granularity in access control, enabling an authorized local attacker to escalate privileges. Documents indicate a Privilege Escalation impact and note updates have been released by Microsoft to address the vulne...

CVE-2026-55948

CVE-2026-55948 is a use-after-free vulnerability in Microsoft Office Excel that can allow local code execution. Affected: Excel (Office). Root cause: use-after-free in the Excel component. Impact: HIGH for confidentiality, integrity, and availability. CVSS v3.1 base score 7.8; attack vector LOCAL...

CVE-2026-55899

Microsoft Excel is affected by a stack-based buffer overflow (CVE-2026-55899) that can allow a local attacker to execute code with high impact. The CVSS indicates local access with user interaction required and high confidentiality/integrity/availability impact. Root cause: overflow in Excel’s ha...

CVE-2026-54988

CVE-2026-54988 is an out-of-bounds read vulnerability affecting Microsoft Excel, enabling a local attacker to disclose information. The existing sources confirm the vulnerability in Microsoft Office Excel with local access requiring user interaction, but do not specify exact vulnerable versions, ...

CVE-2026-50678

CVE-2026-50678: A heap-based buffer overflow in Microsoft Excel (Office) allows local information disclosure. CVSS v3.1 base score 6.6 (Medium): AV:L, AC:L, PR:N, UI:R, S:U, C:L, I:L, A:H. No exploit details are provided in the accompanying documents; remediation status/patch info not specified.

CVE-2026-50675

CVE-2026-50675 describes a heap-based buffer overflow in Microsoft Office Excel that allows a local attacker to execute code on the affected system. The connected sources confirm the issue is tied to Excel, with a high-severity CVSS 3.1 score (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No specific vul...

CVE-2026-54108

CVE-2026-54108 affects Microsoft SharePoint Server. An authorized attacker can influence a file name or path in SharePoint, enabling network-based spoofing. CVSS v3.1: 6.5 (MEDIUM), AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Root cause details are not provided in the supplied documents; no exploitation...

CVE-2026-50520

CVE-2026-50520: Visual Studio Code is affected by a command-injection vulnerability due to improper neutralization of special elements in a command, enabling a local attacker to execute code. The CVSS v3.1 base score is 8.4 (HIGH) with LOCAL attack vector, no user interaction required, and high i...

CVE-2026-55002

Technical details about CVE-2026-55002 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-55144

The CVE-2026-55144 vulnerability concerns Windows Cryptography API: Next Generation (CNG). The issue is a missing cryptographic step in the Windows CryptoAPI that could allow an authorized, local attacker to tamper data, with impact to confidentiality and integrity (CVSSv3.1: Local attack, Low sk...

CVE-2026-54118

CVE-2026-54118 affects Microsoft SQL Server. The vulnerability arises from deserialization of untrusted data, enabling a network-based remote code execution by an authorized attacker. The CVSS 3.1 base score is 8.8 (HIGH) with network attack vector, low attack complexity, requiring low privileges...

CVE-2026-54117

CVE-2026-54117 affects Microsoft SQL Server and is caused by deserialization of untrusted data, enabling an authorized attacker to execute code over a network. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and privileges required as LOW; impact to confidential...

CVE-2026-55011

CVE-2026-55011 : The vulnerability is a local code execution in Microsoft Defender caused by an integer underflow (wrap/wraparound), allowing an unauthorized attacker to run code on the affected system. The available documents consistently describe a local-execution impact from this underflow; no...

CVE-2026-55012

CVE-2026-55012 is a Microsoft Defender vulnerability described as an integer overflow/wraparound that enables local code execution. The CVSS details indicate a Local attack vector with User Interaction required, no privileges required, and impacts to Confidentiality, Integrity, and Availability (...

CVE-2026-55009

CVE-2026-55009 describes a deserialization of untrusted data in Microsoft Exchange Server that enables a locally authenticated attacker to elevate privileges. The CVSSv3.1 details show a Local attack vector, Low attack complexity, Low privileges required, and No user interaction, with High impact...

CVE-2026-50338

Technical details are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2026-55006

Microsoft Exchange Server vulnerability CVE-2026-55006: Insufficient granularity of access control enables local privilege escalation for an authorized attacker. Root cause: lack of fine-grained access controls. Impact: high confidentiality, integrity, and availability impact per CVSS 3.1 (AV:L/A...

CVE-2026-55008

CVE-2026-55008 affects Microsoft Exchange Server and is caused by improper neutralization of input during web page generation, enabling cross-site scripting. The NVD entry lists a high-severity CVSS 3.1 base score of 9.6 (NETWORK, LOW attack complexity, NONE privileges, user interaction required,...

CVE-2026-54122

CVE-2026-54122 describes a heap-based buffer overflow in Windows GDI+ that enables local code execution by an unauthenticated attacker. The vulnerability affects the Windows GDI+ component and is rated high (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4). The available documents confirm the ...

CVE-2026-55005

CVE-2026-55005 is a reported heap-based buffer overflow in Microsoft Exchange Server that enables an authorized attacker to execute code over the network. According to the sources, the vulnerability can be triggered remotely (attack vector: NETWORK) with low privileges required and no user intera...

CVE-2026-54995

CVE-2026-54995 refers to a use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). The flaw could allow an unauthenticated attacker to execute arbitrary code over the network. Public references in the provided docs (NVD, MSRC update guidance, and patch reviews) c...

CVE-2026-55003

CVE-2026-55003 affects Windows Remote Desktop Protocol (RDP). The vulnerability arises from a use of an uninitialized resource, enabling an unauthenticated attacker to disclose information over the network. The CVSS 3.1 Base score is 6.5 (Medium); attack vector: Network, privileges required: None...

CVE-2026-54997

Public technical details are not provided in the supplied documents for CVE-2026-54997. No specifics on affected products, versions, root cause, or remediation are available here. Monitor for updates from official sources.

CVE-2026-54999

The CVE-2026-54999 entry concerns a race condition in Windows TCP/IP where concurrent access to a shared resource allows an unauthorized attacker on an adjacent network to execute code. Documented impact is remote code execution with high severity (CVSSv3.1: AV=A, AC=L, PR=N, UI=N, S=U, C=H, I=H,...