412514 matches found
CVE-2026-106173: Improper Limitation of a Pathname to a Restricted Directory
A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...
CVE-2026-83787: Authentication Bypass Using an Alternate Path or Channel
Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally...
CVE-2026-85814: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-83646: Active Directory Federation Services (AD FS) Spoofing Vulnerability
Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...
CVE-2026-69880: Access of Resource Using Incompatible Type
Access of resource using incompatible type 'type confusion' in Desktop Window Manager allows an authorized attacker to elevate privileges locally...
CVE-2026-69639: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network...
CVE-2026-85931: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Distributed File System DFS allows an authorized attacker to execute code over a network...
CVE-2026-96302: Use After Free
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-106621: Improper Control of Generation of Code
ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...
CVE-2026-74035: Incorrect Authorization
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...
CVE-2026-96252: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-70229: Incorrect Authorization
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-96300: Allocation of Resources Without Limits or Throttling
Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network...
CVE-2026-102856: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-83515: RPC Runtime Information Disclosure Vulnerability
Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network...
CVE-2026-109833: Stack-based Buffer Overflow
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reac...
CVE-2026-83846: Use After Free
Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...
CVE-2026-95502: Allocation of Resources Without Limits or Throttling
A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses uncontrolled resource consumption. Exploitation requires an administrator to have configured Git Sync with that server...
CVE-2026-85823: Use After Free
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...
CVE-2026-70149: Heap-based Buffer Overflow
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver csc.sys allows an authorized attacker to disclose information locally...
CVE-2026-88162: Incorrect Authorization
Improper authorization in Windows Encrypting File System EFS allows an authorized attacker to perform tampering locally...
CVE-2026-85935: Buffer Over-read
Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally...
CVE-2026-83658: Missing Authorization
Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally...
CVE-2026-88135: Missing Authorization
Improper access control in WebDAV allows an authorized attacker to elevate privileges locally...
CVE-2026-88204: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-88094: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Storage Library allows an authorized attacker to elevate privileges over a network...
CVE-2026-85115: Generation of Error Message Containing Sensitive Information
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.62. Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtai...
CVE-2026-83569: Heap-based Buffer Overflow
Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally...
CVE-2026-88179: Out-of-bounds Read
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...
CVE-2026-85810: Use After Free
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally...
CVE-2026-83578: Integer Underflow (Wrap or Wraparound)
Integer underflow wrap or wraparound in Windows PowerShell allows an unauthorized attacker to execute code over a network...
CVE-2026-83727: Buffer Over-read
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...
CVE-2026-85824: Use After Free
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...
CVE-2026-70242: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
CVE-2026-97827: Out-of-bounds Read
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
CVE-2026-69954: Buffer Over-read
Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally...
CVE-2026-97825: Out-of-bounds Read
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
CVE-2026-97817: Heap-based Buffer Overflow
Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network...
CVE-2026-83719: Buffer Over-read
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally...
CVE-2026-83678: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally...
CVE-2026-69969: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Windows AppX Deployment Service allows an authorized attacker to disclose information locally...
CVE-2026-96315: Missing Authorization
Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally...
CVE-2026-88209: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-88145: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
CVE-2026-96215: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Autopilot allows an authorized attacker to elevate privileges locally...
CVE-2026-69922: Out-of-bounds Read
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...
CVE-2026-70161: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' in .NET allows an authorized attacker to elevate privileges locally...
CVE-2026-70086: Use After Free
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
CVE-2026-70079: Improper Enforcement of Behavioral Workflow
Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network...