CVE-2026-97824: Out-of-bounds Read

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...

CVE-2026-88153: Out-of-bounds Read

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

Microsoft Windows: CVE-2026-96244: Windows Internal System User Profile Elevation of Privilege Vulnerability

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

CVE-2026-87689: Missing Authentication for Critical Function

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

Microsoft Windows: CVE-2026-70116: Windows Resilient File System (ReFS) Security Feature Bypass Vulnerability

Stack-based buffer overflow in Windows Resilient File System ReFS allows an unauthorized attacker to bypass a security feature with a physical attack...

CVE-2026-85836: Use After Free

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-83784: Absolute Path Traversal

Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges over a network...

CVE-2026-83917: Use After Free

Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally...

CVE-2026-85375: Use After Free

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-84017: Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability

Null pointer dereference in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to deny service over a network...

CVE-2026-70163: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-84020: Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

Use after free in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-85322: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

Use of uninitialized resource in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...

CVE-2026-70293: Use of Uninitialized Resource

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2026-69977: Use After Free

Use after free in Quality Windows Audio/Video Experience QWAVE service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-85808: Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability

Out-of-bounds read in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-85794: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

Out-of-bounds read in Windows Routing and Remote Access Service RRAS allows an authorized attacker to disclose information locally...

CVE-2026-109526: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used...

CVE-2026-109945: Concurrent Execution using Shared Resource with Improper Synchronization

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-70291: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

CVE-2026-103853: Out-of-bounds Read

Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-88143: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

CVE-2026-85874: Use After Free

Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally...

CVE-2026-70299: Incorrect Authorization

Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-83914: Use After Free

Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network...

CVE-2026-83779: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83741: Internet Explorer Elevation of Privilege Vulnerability

Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally...

CVE-2026-58249: Integer Underflow (Wrap or Wraparound)

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful...

CVE-2026-70116: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Resilient File System ReFS allows an unauthorized attacker to bypass a security feature with a physical attack...

CVE-2026-96996: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-53420: Buffer Copy without Checking Size of Input

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access...

CVE-2026-96912: Use After Free

Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96912: Windows Client License Service Elevation of Privilege Vulnerability

Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally...

CVE-2026-83836: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally...

CVE-2026-83789: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70115: Use After Free

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-83919: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally...

CVE-2026-105902: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

Microsoft Windows: CVE-2026-83771: Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability

Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-65172: Missing Authorization

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may...

CVE-2026-83767: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-103565: Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-83700: Use After Free

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-85373: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

CVE-2026-74031: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...

CVE-2026-97763: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

CVE-2026-15468: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3...

CVE-2026-110131: Missing Authorization

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

Microsoft Windows: CVE-2026-85833: Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-54641: Authorization Bypass Through User-Controlled Key

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID...