Microsoft Windows: CVE-2026-88226: Windows Storage Port Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack...

CVE-2026-85900: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-87713: Use After Free

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-106615: Incorrect Authorization

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-74041: Improper Handling of Case Sensitivity

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on...

CVE-2026-92922: Improper Neutralization of Input During Web Page Generation

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerab...

CVE-2026-85352: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-97798: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in a command 'argument injection' in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-69915: Use After Free

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-19938: Use After Free

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-96306: Out-of-bounds Read

Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70212: Improper Restriction of Communication Channel to Intended Endpoints

Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally...

CVE-2026-88185: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-97792: Incorrect Permission Assignment for Critical Resource

Improper access control in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-88191: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-97810: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-97843: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-83732: Use After Free

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-53711: Improper Neutralization of Input During Web Page Generation

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event...

CVE-2026-70174: Improperly Implemented Security Check for Standard

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network...

CVE-2026-87699: Heap-based Buffer Overflow

Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally...

CVE-2026-70132: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-88140: Out-of-bounds Read

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-84015: Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Access Point-to-Point Protocol PPP EAP-TLS allows an unauthorized attacker to execute code over a network...

CVE-2026-70151: Use After Free

Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally...

CVE-2026-12656: Allocation of Resources Without Limits or Throttling

A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to it...

CVE-2026-110104: Use of Password Hash With Insufficient Computational Effort

Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register stores unsalted MD5 digests in userinfo.password. Attackers who obtain the password column through a database leak or backup exposure ca...

Microsoft Windows: CVE-2026-85824: Windows Composite Image File System Elevation of Privilege Vulnerability

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

CVE-2026-105151: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-85369: Out-of-bounds Read

Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally...

CVE-2026-83773: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally...

CVE-2026-83935: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network...

CVE-2026-70161: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in .NET allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-69733: Windows Update Elevation of Privilege Vulnerability

Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally...

CVE-2026-96945: Uncaught Exception

Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network...

Microsoft Exchange: CVE-2026-87695: Microsoft Exchange Server Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

CVE-2026-69471: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-88112: Untrusted Pointer Dereference

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-87697: Deserialization of Untrusted Data

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network...

CVE-2026-109890: Missing Authorization

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...

CVE-2026-54868: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7...

CVE-2026-69867: Out-of-bounds Read

Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally...

CVE-2026-77496: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network...

CVE-2026-105006: Use After Free

Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack...

Microsoft Office: CVE-2026-88150: Microsoft Office Word Remote Code Execution Vulnerability

Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-70278: Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally...

CVE-2026-97312: Out-of-bounds Write

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-96522: Out-of-bounds Write

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-83774: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2026-54870: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...