Microsoft Office: CVE-2026-105591: Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-102192: Windows Failover Cluster Denial of Service Vulnerability

Integer underflow wrap or wraparound in Windows Failover Cluster allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-69913: Windows TCP/IP Remote Code Execution Vulnerability

Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-85933: Windows Print Spooler Components Elevation of Privilege Vulnerability

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-85371: Network Policy Server (NPS) Remote Code Execution Vulnerability

Use after free in Network Policy Server NPS allows an unauthorized attacker to execute code over a network...

Microsoft Exchange: CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network...

CVE-2026-83639: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70031: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network...

CVE-2026-105016: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network...

CVE-2026-70248: NULL Pointer Dereference

Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally...

CVE-2026-96946: Use After Free

Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...

CVE-2026-70188: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96236: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-83517: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network...

CVE-2026-96535: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

CVE-2026-109766: Protection Mechanism Failure

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109769: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109772: Undefined Security Weakness

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109746: Protection Mechanism Failure

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109755: Protection Mechanism Failure

Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-96044: Improper Validation of Specified Type of Input

No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-83862: Use After Free

Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-94453: Use After Free

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...

CVE-2026-85115: Generation of Error Message Containing Sensitive Information

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.62. Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtai...

CVE-2026-92892: Improper Neutralization of Argument Delimiters in a Command

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later...

CVE-2026-84284: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect...

CVE-2026-104252: Improper Neutralization of Input During Web Page Generation

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML...

CVE-2026-102204: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...

CVE-2026-108377: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...

CVE-2026-23705: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all...

CVE-2026-23706: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1...

CVE-2026-109782: Undefined Security Weakness

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5...

CVE-2026-109783: Undefined Security Weakness

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5...

CVE-2026-78335: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations...

Microsoft Windows: CVE-2026-71347: Windows Security Center Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Security Center allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-70072: Windows Netlogon Denial of Service Vulnerability

Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-85945: Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88124: Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-69898: Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-66822: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-88160: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-63357: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially craft...

Microsoft Windows: CVE-2026-70277: Windows Fast FAT File System Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-85868: Windows Common Log File System Driver Elevation of Privilege Vulnerability

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-85790: Use After Free

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...

CVE-2026-110255: Server-Side Request Forgery (SSRF)

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...

CVE-2026-95634: Server-Side Request Forgery (SSRF)

CAI Content Credentials is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-87713: Use After Free

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-109854: Use of Uninitialized Variable

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and...

CVE-2026-109770: Improper Input Validation

Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...