CVE-2026-87700: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-83580: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Client-Side Caching CSC Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70054: Windows NetBIOS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally...

CVE-2026-88071: Double Free

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally...

CVE-2026-70113: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69926: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in Desktop Window Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-70056: Use After Free

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-97768: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

CVE-2026-69957: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-97815: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network...

CVE-2026-70260: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...

CVE-2026-85361: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-89116: Improper Neutralization of Special Elements used in an OS Command

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

Microsoft Windows: CVE-2026-85795: Windows Text Services Framework Elevation of Privilege Vulnerability

Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally...

CVE-2026-108975: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function moveuploadedfile of the file admin/addadmin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The...

CVE-2026-87709: Execution with Unnecessary Privileges

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

CVE-2026-83778: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-83516: Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

Out-of-bounds read in Windows Local Security Authority Subsystem Service LSASS allows an unauthorized attacker to deny service over a network...

CVE-2026-97801: Improper Validation of Specified Type of Input

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network...

CVE-2026-83656: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-89110: Exposed Dangerous Method or Function

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

CVE-2026-70035: Deserialization of Untrusted Data

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network...

CVE-2026-83735: Release of Invalid Pointer or Reference

Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-100214: Deserialization of Untrusted Data

Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network...

CVE-2026-96921: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally...

CVE-2026-83662: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue...

CVE-2026-110156: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: High...

CVE-2026-109951: Out-of-bounds Read

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-110115: Improper Limitation of a Pathname to a Restricted Directory

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...

CVE-2026-89120: Initialization of a Resource with an Insecure Default

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

CVE-2026-110224: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing...

CVE-2026-90531: Improper Restriction of XML External Entity Reference

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does...

CVE-2026-56826: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-96911: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-96916: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-69966: Kernel Streaming Service Driver Elevation of Privilege Vulnerability

Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally...

CVE-2026-110136: Use After Free

Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-100137: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-108967: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/editcredit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to...

Microsoft Windows: CVE-2026-62879: Windows SmartScreen Tampering Vulnerability

Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally...

CVE-2026-102074: Stack-based Buffer Overflow

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

CVE-2026-34633: Server-Side Request Forgery (SSRF)

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is...

Microsoft Windows: CVE-2026-102197: Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-102201: Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally...

CVE-2026-102199: Stack-based Buffer Overflow

Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-102199: Microsoft Windows Codecs Library Denial of Service Vulnerability

Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network...

CVE-2026-102197: Use After Free

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-102201: Use After Free

Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally...

CVE-2026-102196: Use After Free

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-102196: Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...