CVE-2026-57098

CVE-2026-57098 is an improper verification of cryptographic signature vulnerability in Windows RDP Client (Microsoft Remote Desktop App for Windows). An unauthorized network attacker can disclose information with no user interaction and no prior privileges required. The CVSS 3.1 score is 7.5 (HIG...

CVE-2026-77482

CVE-2026-77482 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity but required user interac...

CVE-2026-85360

A use after free flaw in the Windows Kernel allows a local, authenticated attacker to elevate privileges . The vulnerability is scored CVSS 3.1 7.0 (HIGH) with a local attack vector , high attack complexity , low privileges required , and no user interaction , resulting in high impact to confiden...

CVE-2026-83941

CVE-2026-83941 is a missing authorization vulnerability in Entra ID (Microsoft's identity and access management service) that allows an attacker with low privileges to elevate privileges over a network. The assigned CVSS 3.1 score is 9.9 (CRITICAL) with a scope change, indicating high impact on b...

CVE-2026-69782

Windows DNS Server is affected by a race condition caused by concurrent execution using a shared resource with improper synchronization. This flaw allows an unauthorized attacker to achieve remote code execution over the network with no privileges required , though the attack complexity is rated ...

CVE-2026-70091

CVE-2026-70091 is a race condition in Windows DNS caused by concurrent execution using a shared resource with improper synchronization. An unauthorized, network-based attacker can exploit this to cause a denial of service . The vulnerability is rated CVSS 5.9 (MEDIUM) with a network attack vector...

CVE-2026-69522

This is a heap-based buffer overflow in Visual Studio (and .NET , per the CVE record) that enables an unauthorized, remote attacker to achieve code execution over a network. The CVSS 3.1 base score is 8.8 (High) with an attack vector of network , low complexity, no privileges required, but user i...

CVE-2026-62895

Azure Arc SQL Server Extension is affected by a permissive cross-domain policy that permits untrusted domains, enabling an elevation of privilege over the network. The vulnerability requires user interaction and no prior privileges (CVSS 3.1: 8.8 HIGH , AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The r...

CVE-2026-69341

CVE-2026-69341 is a use-after-free vulnerability in Windows Image Acquisition (WIA) that allows an authorized local attacker to escalate privileges. The flaw resides in a memory-management error where a freed object is referenced again, enabling privilege escalation when exploited locally. The CV...

CVE-2026-62744

A heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior authentication (CVSS 3.1 base score: 8.8 – HIGH ). No specific affected version range or pat...

CVE-2026-62694

CVE-2026-62694 is a use-after-free vulnerability in Windows Installer that allows a locally authenticated attacker with low privileges to escalate privileges . The attack requires high complexity and no user interaction , with high impact on confidentiality, integrity, and availability (CVSS 3.1:...

CVE-2026-62706

CVE-2026-62706 is an out-of-bounds read in Microsoft Windows Media Foundation that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , meaning exploitation requires user interaction but no prior au...

CVE-2026-9216

An insufficient input validation vulnerability affects several NETGEAR RAX series routers (RAX30, RAX35, RAX38, RAX40, RAXE300 ). A network-adjacent attacker with low privileges (e.g., WiFi credentials) can crash the router's management UI , causing limited availability impact. No confidentiality...

CVE-2026-9215

A CSRF vulnerability in the web interfaces of NETGEAR XR500, XR1000, and XR1000v2 routers allows an attacker, via social engineering , to induce a router administrator into tampering with router configuration, resulting in high integrity and availability impact with no confidentiality impact. The...

CVE-2026-86073

n8n , an open source workflow automation platform, is affected by a per-resource OAuth consent bypass prior to versions 2.37.7 and 2.38.1 . The OAuth token endpoint bound the initial access token to the consented resource but did not bind the refresh token ; upon refreshing, it only verified the ...

CVE-2026-82533

DeepSeek Harness prior to 0.1.2-alpha.1 contains an authentication bypass in its local HTTP control-plane API. The root cause is that the server validates only the client-supplied Host header rather than the actual TCP connection origin, allowing a network attacker to spoof authentication. This p...

CVE-2026-81531

CVE-2026-81531 affects Omada Controller (multiple versions, per the CNA title). An API endpoint intended for Controller initialization remains accessible after the initialization process completes, allowing unauthenticated remote users to query it and obtain account-related information . Successf...

CVE-2026-75156

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience of Azure AD id_tokens during OAuth login. Because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, a token minted in any Azure tenant—including one an attacker creates—passes sig...

CVE-2026-86668

A cross-site scripting (XSS) vulnerability exists in aircheng-org iWebShop-5 (versions up to 5.15 ), located in the uploadFile function within the file controllers/pic.php . Manipulation of the outerSrc/selectPhoto argument enables the attack remotely with no required privileges, though user inte...

CVE-2026-78216

AshLua (an Elixir library exposing Ash read actions to Lua scripts via an eval action) contains a field-policy bypass in its aggregate read operations (list, min, max, first, sum, avg). Ash field policies redact forbidden fields on returned records, but that redaction does not apply to aggregate ...

CVE-2026-84392

A NULL Pointer Dereference (CWE-476) in Fortinet FortiOS (7.2 all, 7.4 all), FortiPAM (1.0 through 1.9.0), and FortiProxy (7.2 all, 7.4 all, 7.6.0–7.6.6) allows an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. The CVSS 3.1 score is 2.7 (Low) , reflecting high privil...

CVE-2026-22575

An improper access control vulnerability in Fortinet FortiManager and FortiManager Cloud allows a privileged administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. Affected versions include FortiManager 7.6.0–7.6.4, 7.4.0–7.4.10, and 7.2 (all versio...

CVE-2026-84391

A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer versions 7.6.3 through 7.6.6 may allow an attacker to cause denial of service . The CVSS 3.1 score is 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible, low-complexity attack re...

CVE-2026-84393

Fortinet FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 are affected by an improper validation of certificate with host mismatch vulnerability that may allow a remote attacker to achieve information disclosure . The attack requires high complexity and no user interaction or prior ...

CVE-2026-26084

Fortinet FortiSandbox is affected by an improper access control vulnerability (CVE-2026-26084) that may allow an unauthenticated, remote attacker to access sensitive information via crafted HTTP requests . Affected versions include FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, FortiSandbox Cloud 5.0.4–5...

CVE-2026-84385

Fortinet FortiSOAR (both PaaS and on-premise ) is affected by an improper access control vulnerability spanning versions 7.3 through 7.6.6 (all 7.3 and 7.4 versions; 7.5.0–7.5.3; 7.6.0–7.6.6). The flaw may allow an attacker with low privileges to achieve privilege escalation over the network with...

CVE-2026-84389

Fortinet FortiSIEM versions 7.5.0 through 7.5.1 and 7.4.1 through 7.4.2 are affected by an open redirect vulnerability that may allow an attacker to execute unauthorized code or commands. The CVSS v3.1 base score is 3.1 (LOW) , with a network attack vector, high complexity, no privileges required...

CVE-2026-78230

ash_ai (an Elixir/Erlang library exposing Ash resources to language-model tool calls) contains an authorization bypass in its read tool. The tool's aggregate result types (min, max, sum, avg ) build an ad-hoc Ash.Query.Aggregate over a named field and return its raw value, but Ash field policies ...

CVE-2026-84387

CVE-2026-84387 is a command injection vulnerability in Fortinet FortiSandbox affecting versions 5.2.0 , 5.0.0 through 5.0.6 , and 4.4.0 through 4.4.9 . The flaw involves improper neutralization of special elements in a command, potentially allowing an attacker to execute unauthorized code or comm...

CVE-2026-84386

CVE-2026-84386 is an unverified ownership vulnerability in Fortinet FortiClient for Windows , affecting versions 7.4.0 through 7.4.7 and all versions of the 7.2 line. The flaw may allow an attacker to bypass access control , resulting in low integrity and high availability impact. The CVSS 3.1 sc...

CVE-2026-12767

Langflow OSS (versions 1.0.0–1.11.5) is vulnerable to Server-Side Request Forgery (SSRF) (CWE-918). The root cause is missing egress validation on server-side URL fetches: the IBM Db2 Vector Store connector fetches a user-controlled SSL certificate URL without SSRF validation, and the OpenAI Chat...

CVE-2026-86667

A SQL injection vulnerability exists in aircheng-org iWebShop-5 (up to version 5.15), specifically in the member_list function within controllers/member.php. The flaw is triggered by manipulation of the Search argument , allowing a remote, authenticated attacker to execute arbitrary SQL queries. ...

CVE-2026-82076

An integer overflow in the query planning component of MongoDB Server allows an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. A specially crafted query causes the server to consume memory without bound during query planning, eventually...

CVE-2026-82075

CVE-2026-82075 is an uncontrolled resource consumption vulnerability in the request-handling path of the MongoDB sharded-cluster router process. An unauthenticated client with network access to a router port can supply connection-monitoring parameters that cause the server to expend CPU without r...

CVE-2026-82074

CVE-2026-82074 is an incorrect authorization vulnerability in the MongoDB Server aggregation framework . An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what i...

CVE-2026-82073

MongoDB Server aggregation framework is affected by an improper validation vulnerability (CVE-2026-82073). When Atlas Search features are in use, an authenticated user with limited read privileges can bypass view-level authorization checks and read data from unauthorized collections by manipulati...

CVE-2026-82071

MongoDB Server is affected by an insufficient validation issue in storage engine configuration options. An authenticated user with write privileges can supply crafted parameters during collection creation that override internal storage metadata, resulting in an out-of-bounds memory write in the s...

CVE-2026-82070

CVE-2026-82070 is an insufficiently protected credentials vulnerability in MongoDB Server's diagnostic reporting interface . The interface fails to redact credentials that are properly masked in server log output, allowing an authenticated user with monitoring-level permissions to access cleartex...

CVE-2026-82069

CVE-2026-82069 affects MongoDB Server in the query statistics serialization component on the sharded cluster router . An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries, allowing users with monitoring privileg...

CVE-2026-82068

MongoDB Server is affected by a denial-of-service vulnerability where an authenticated user with write privileges can trigger a persistent fatal assertion crash by sending specially crafted retryable write commands . Unlike transient crashes, the crash state is durably persisted , causing the ser...

CVE-2026-82066

A heap out-of-bounds read vulnerability exists in the query planning component of MongoDB Server . An authenticated user with database read and write privileges can trigger the issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The leaked...

CVE-2026-82067

MongoDB Server is affected by an improper handling of case sensitivity in its configuration validation component , which may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated attacker with network access to a deployment in this condi...

CVE-2026-82065

CVE-2026-82065 affects the MongoDB Server storage engine integration layer. An authenticated user with collection creation privileges can supply malformed storage configuration options that bypass validation and are persisted to durable metadata. When that metadata is later read by diagnostic ope...

CVE-2026-82064

MongoDB Server contains a denial-of-service vulnerability in its read concern processing logic . An unauthenticated network user can trigger an assertion failure on a specific type of replica set member , causing the server process to terminate. The root cause is that the assertion's assumptions ...

CVE-2026-82062

MongoDB Server is affected by an improper authorization flaw in the applyOps command . An authenticated user with elevated internal privileges can bypass a disabled feature gate by specifying an internal replication mode value not intended to be client-selectable. This enables container operation...

CVE-2026-82063

A use-after-free flaw in the cursor management component of MongoDB Server allows an authenticated user to trigger a denial of service . Under specific timing conditions during cursor operations, a stale pointer to a freed resource is retained and dereferenced during cursor cleanup, causing a ser...

CVE-2026-82061

CVE-2026-82061 is a use-after-free vulnerability in MongoDB Server 's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, resulting in a server process crash (denial of ser...

CVE-2026-82060

CVE-2026-82060 is an insufficient validation flaw in MongoDB Server affecting sharded collections. During document insertion, shard key values were not properly validated, allowing authenticated users to store operator-shaped objects as shard key values. When change stream events for such documen...

CVE-2026-82059

CVE-2026-82059 affects MongoDB Server , where an internal aggregation expression was incorrectly exposed to any authenticated user instead of being restricted to internal cluster operations. An attacker with read-only privileges can craft a malformed index specification within this expression to ...

CVE-2026-82058

MongoDB 's mongod server is vulnerable to a denial-of-service flaw in its JSON Schema validation error generation code. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error path performs an unsafe numeric conversion on t...