414110 matches found
CVE-2026-69856: Use After Free
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally...
CVE-2026-96223: Use After Free
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally...
CVE-2026-96862: Out-of-bounds Read
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally...
CVE-2026-70292: Out-of-bounds Read
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...
CVE-2026-83843: Out-of-bounds Read
Out-of-bounds read in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...
CVE-2026-96325: Missing Reference to Active Allocated Resource
Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network...
CVE-2026-83866: Use After Free
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...
CVE-2026-83909: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...
CVE-2026-106173: Improper Limitation of a Pathname to a Restricted Directory
A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...
CVE-2026-107917: Improper Input Validation
Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a...
CVE-2026-107918: Improper Input Validation
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a...
CVE-2026-109960: Improper Neutralization of Input During Web Page Generation
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...
CVE-2026-83706: Use After Free
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...
CVE-2026-83912: Use After Free
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally...
CVE-2026-85375: Use After Free
Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...
CVE-2026-95633: Improper Verification of Cryptographic Signature
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does no...
CVE-2026-96216: Use After Free
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-96118: Out-of-bounds Read
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-23706: Improper Neutralization of Special Elements used in an SQL Command
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...
CVE-2026-83768: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-109453: Heap-based Buffer Overflow
Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-85353: Out-of-bounds Read
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network...
CVE-2026-110230: Missing Authorization
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...
CVE-2026-70271: Use After Free
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...
CVE-2026-97014: Out-of-bounds Read
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
CVE-2026-106598: Missing Authorization
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8...
CVE-2026-89309: Missing Authentication for Critical Function
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method...
CVE-2026-85902: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally...
CVE-2026-108961: Improper Control of Generation of Code
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.init of the file paddlex/inference/models/textdetection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possib...
CVE-2026-109777: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-110112: Incorrect Authorization
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...
Microsoft Windows: CVE-2026-70087: Role: DNS Server Security Feature Bypass Vulnerability
Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally...
Microsoft Windows: CVE-2026-70079: Windows DNS Denial of Service Vulnerability
Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-70082: Windows DNS Denial of Service Vulnerability
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-70083: Role: DNS Server Tampering Vulnerability
Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally...
Microsoft Windows: CVE-2026-70119: Windows DNS Remote Code Execution Vulnerability
Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-70127: Windows Domain Name Service Remote Code Execution Vulnerability
Use after free in DNS Server allows an unauthorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-70155: Windows DNS Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-70021: Windows Direct Composition Elevation of Privilege Vulnerability
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-96183: Windows Health and Optimized Experiences Service Information Disclosure Vulnerability
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally...
CVE-2026-85925: Improper Restriction of Communication Channel to Intended Endpoints
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network...
CVE-2026-85926: Use After Free
Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...
CVE-2026-85920: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use toctou race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally...
CVE-2026-85901: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...
CVE-2026-85914: Use After Free
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally...
CVE-2026-85916: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
CVE-2026-85793: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally...
CVE-2026-85792: Use After Free
Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...