28648 matches found
Chromium: CVE-2026-8522 Use after free in Downloads
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-8521 Use after free in Tab Groups
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-8520 Race in Payments
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability
Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network...
Microsoft Entra ID Elevation of Privilege Vulnerability
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...
Microsoft Planetary Computer Pro Information Disclosure Vulnerability
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network...
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
Azure Orbital Spatio Remote Code Execution Vulnerability
Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network...
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
Azure Stack HCI Information Disclosure Vulnerability
Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network...
Microsoft Copilot Tampering Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...
Azure Virtual Network Gateway Remote Code Execution Vulnerability
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network...
Microsoft Power Pages Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Microsoft Power Pages allows an unauthorized attacker to execute code over a network...
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
Azure Resource Manager Elevation of Privilege Vulnerability
Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...
Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Azure Privileged Identity Management PIM allows an authorized attacker to elevate privileges over a network...
gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
...
Unbounded name compression in certain cases causes degradation of service
...
Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
...
Degradation of service with unbounded NSEC3 hash calculations
...
Another 'ghost domain names' attack variant
...
Jostle logic bypass degrades resolution performance
...
Long list of incoming EDNS options degrades performance
...
Possible arbitrary code execution during DNSSEC validation
...
Use after free and crash under special conditions in RPZ code
...
Crash during DNSSEC validation of malicious content
...
Possible cache poisoning via promiscuous records for the authority section
...
Packet of death with DNSCrypt
...
Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write
...
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
...
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
...
Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy
...
Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
...
Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()
...
Rsync < 3.4.3 Integer Overflow Information Disclosure
...
Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
...
net: qrtr: ns: Limit the maximum server registration per node
...
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
...
Microsoft Defender Denial of Service Vulnerability
...
Microsoft Defender Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network...
Windows BitLocker Security Feature Bypass Vulnerability
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be...
Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
Microsoft Defender Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Microsoft Defender allows an authorized attacker to elevate privileges locally...
GNU Binutils objdump bucomm.c display_info memory leak
...
Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network...
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
...
Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
...
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects
...