CVE-2026-69363: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network...

CVE-2026-70566: NULL Pointer Dereference

Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally...

CVE-2026-69639: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network...

CVE-2026-61931: Use After Free

Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69763: Use After Free

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-69766: Use After Free

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-69935: Use After Free

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally...

CVE-2026-69795: NULL Pointer Dereference

Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally...

CVE-2026-69867: Out-of-bounds Read

Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally...

CVE-2026-69840: Use After Free

Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally...

CVE-2026-69850: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70229: Windows Active Directory Domain Services Remote Code Execution Vulnerability

Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...

CVE-2026-96929: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

Microsoft Office: CVE-2026-97777: Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

CVE-2026-83965: Stack-based Buffer Overflow

Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-109758: Improperly Controlled Modification of Object Prototype Attributes

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

Microsoft Windows: CVE-2026-88168: Windows Bind Filter Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88071: Windows Hyper-V Elevation of Privilege Vulnerability

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally...

CVE-2026-88112: Untrusted Pointer Dereference

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-110103: Improper Neutralization of Input During Web Page Generation

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...

CVE-2026-103824: NULL Pointer Dereference

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interacti...

CVE-2026-83966: Out-of-bounds Write

Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-70041: Buffer Over-read

Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally...

CVE-2026-96855: Missing Authorization

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-83835: Buffer Over-read

Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally...

CVE-2026-85908: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88149: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70137: Windows Remote Access Connection Manager Information Disclosure Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-96118: Windows Graphics Kernel Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-108955: Out-of-bounds Read

A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function ggufinitfromfile of the file ggml.c of the component GGUF Parser. This manipulation of the argument dataoffset causes out-of-bounds read. The attack requires local access...

CVE-2026-97812: Double Free

Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally...

CVE-2026-105597: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...

CVE-2026-102194: Use After Free

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-103554: Use After Free

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70195: Use After Free

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally...

CVE-2026-85810: Use After Free

Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally...

CVE-2026-101168: Insertion of Sensitive Information into Log File

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to...

Microsoft Windows: CVE-2026-83511: Active Directory Federation Services (AD FS) Spoofing Vulnerability

Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-109943: Double Free

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-83925: Use of Uninitialized Resource

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-96950: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69226: Incorrect Authorization

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled disableSignup=true. An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized...

CVE-2026-44415: Path Traversal: '.../...//'

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in...

CVE-2026-88074: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96915: Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2026-70024: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network...

CVE-2026-96249: Use After Free

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83901: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

CVE-2026-85927: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70247: HTTP.sys Remote Code Execution Vulnerability

Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally...