414110 matches found
CVE-2026-23706: Improper Neutralization of Special Elements used in an SQL Command
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...
CVE-2026-83768: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-109453: Heap-based Buffer Overflow
Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-85353: Out-of-bounds Read
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network...
CVE-2026-110230: Missing Authorization
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...
CVE-2026-70271: Use After Free
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...
CVE-2026-97014: Out-of-bounds Read
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
CVE-2026-106598: Missing Authorization
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8...
CVE-2026-89309: Missing Authentication for Critical Function
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method...
CVE-2026-108961: Improper Control of Generation of Code
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.init of the file paddlex/inference/models/textdetection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possib...
CVE-2026-109777: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-110112: Incorrect Authorization
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...
Microsoft Windows: CVE-2026-70087: Role: DNS Server Security Feature Bypass Vulnerability
Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally...
Microsoft Windows: CVE-2026-70079: Windows DNS Denial of Service Vulnerability
Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-70082: Windows DNS Denial of Service Vulnerability
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-70083: Role: DNS Server Tampering Vulnerability
Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally...
Microsoft Windows: CVE-2026-70119: Windows DNS Remote Code Execution Vulnerability
Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-70127: Windows Domain Name Service Remote Code Execution Vulnerability
Use after free in DNS Server allows an unauthorized attacker to execute code over a network...
Microsoft Windows: CVE-2026-70155: Windows DNS Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network...
Microsoft Windows: CVE-2026-70021: Windows Direct Composition Elevation of Privilege Vulnerability
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally...
Microsoft Windows: CVE-2026-96183: Windows Health and Optimized Experiences Service Information Disclosure Vulnerability
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally...
CVE-2026-85925: Improper Restriction of Communication Channel to Intended Endpoints
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network...
CVE-2026-85926: Use After Free
Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...
CVE-2026-85920: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use toctou race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally...
CVE-2026-85914: Use After Free
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally...
CVE-2026-85798: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Distributed File System DFS allows an authorized attacker to execute code over a network...
CVE-2026-85794: Out-of-bounds Read
Out-of-bounds read in Windows Routing and Remote Access Service RRAS allows an authorized attacker to disclose information locally...
CVE-2026-85918: Use After Free
Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...
CVE-2026-85815: Out-of-bounds Read
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally...
CVE-2026-85812: Files or Directories Accessible to External Parties
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally...
CVE-2026-85821: Out-of-bounds Read
Out-of-bounds read in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to disclose information locally...
CVE-2026-85372: Use After Free
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-85365: Heap-based Buffer Overflow
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally...
CVE-2026-85377: Access of Resource Using Incompatible Type
Access of resource using incompatible type 'type confusion' in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-85825: Concurrent Execution using Shared Resource with Improper Synchronization
Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...
CVE-2026-85826: Out-of-bounds Write
Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-95904: Buffer Over-read
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...
CVE-2026-96851: Buffer Over-read
Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally...
Microsoft Office: CVE-2026-97776: Microsoft Office Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-97773: Microsoft Office Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-97772: Microsoft Office Excel Remote Code Execution Vulnerability
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-97775: Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-97011: Microsoft Office Excel Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-97010: Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-88183: Microsoft Office PowerPoint Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...
Microsoft Office: CVE-2026-88184: Microsoft Office Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...
Microsoft Office: CVE-2026-88156: Microsoft Office Outlook Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
Microsoft Office: CVE-2026-88167: Microsoft Office Word Information Disclosure Vulnerability
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...
Microsoft Office: CVE-2026-88169: Microsoft Office Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...
Microsoft Office: CVE-2026-85340: Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally...