Microsoft Windows: CVE-2026-83855: Windows WLAN Service Denial of Service Vulnerability

Integer underflow wrap or wraparound in Windows WLAN Service allows an unauthorized attacker to deny service over a network...

CVE-2026-83855: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Windows WLAN Service allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-83859: Windows NTFS Elevation of Privilege Vulnerability

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-83859: Use After Free

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83896: Windows Direct Composition Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83860: Windows GDI Denial of Service Vulnerability

Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-83879: Windows Overlay Filter Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-83871: Heap-based Buffer Overflow

Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83871: Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability

Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally...

CVE-2026-83886: Use After Free

Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83774: Windows Win32 Kernel Subsystem Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2026-83860: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network...

CVE-2026-83768: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83768: Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-83883: Use After Free

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83883: Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-83761: Use After Free

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

CVE-2026-83774: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2026-83879: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-83856: Out-of-bounds Read

Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network...

CVE-2026-83872: Incorrect Conversion between Numeric Types

Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83856: Windows Event Logging Service Remote Code Execution Vulnerability

Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-83872: Windows TCP/IP Local Elevation of Privilege Vulnerability

Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83876: Windows Shell Elevation of Privilege Vulnerability

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-83876: Use After Free

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-109412: Exposed Dangerous Method or Function

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information...

CVE-2026-110118: Authorization Bypass Through User-Controlled Key

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-109428: Interpretation Conflict

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-110225: Server-Side Request Forgery (SSRF)

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...

CVE-2026-110230: Missing Authorization

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110105: Missing Authorization

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/reportId, /admin/tags/remove-unuse...

CVE-2026-76976: Improper Neutralization of Input During Web Page Generation

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

CVE-2026-89124: Incorrect Authorization

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...

CVE-2026-89122: URL Redirection to Untrusted Site

SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allo...

CVE-2026-58242: Integer Underflow (Wrap or Wraparound)

SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information...

CVE-2026-83958: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-103825: Out-of-bounds Read

Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious...

CVE-2026-83868: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96949: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-34634: Server-Side Request Forgery (SSRF)

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-102192: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Windows Failover Cluster allows an unauthorized attacker to deny service over a network...

CVE-2026-65150: Out-of-bounds Read

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service...

CVE-2026-109522: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

Microsoft Windows: CVE-2026-96864: Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability

Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-81858: Out-of-bounds Read

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server...

CVE-2026-100138: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-103846: Improper Neutralization of Input During Web Page Generation

Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation o...

CVE-2026-70087: Incorrect Authorization

Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally...

Microsoft Windows: CVE-2026-83664: Windows Portable Device File System Driver Information Disclosure Vulnerability

Access of resource using incompatible type 'type confusion' in Windows Portable Device File System Driver allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-69795: Windows Clipboard Server Elevation of Privilege Vulnerability

Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally...