CVE-2026-48378: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...

CVE-2026-69918: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96920: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-72968: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72968: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72969: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72934: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69596: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69743: Use After Free

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88079: Windows MIDI Service Module Elevation of Privileges Vulnerability

Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83773: Windows MIDI Service Module Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally...

CVE-2026-105443: Improper Access Control

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install...

Microsoft Windows: CVE-2026-70288: Win32k Information Disclosure Vulnerability

Time-of-check time-of-use toctou race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

CVE-2026-83575: Use After Free

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96938: Windows Distributed File System (DFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Distributed File System DFS allows an authorized attacker to elevate privileges locally...

CVE-2026-77090: Improper Restriction of XML External Entity Reference

CVFS contained an XML external entity XXE reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-83759: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Windows Encrypting File System EFS allows an authorized attacker to execute code over a network...

CVE-2026-87700: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-83580: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Client-Side Caching CSC Service allows an authorized attacker to elevate privileges locally...

CVE-2026-110108: Missing Authorization

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName...

Microsoft Windows: CVE-2026-70054: Windows NetBIOS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally...

CVE-2026-53711: Improper Neutralization of Input During Web Page Generation

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event...

CVE-2026-74045: Heap-based Buffer Overflow

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fimgeneratealert where fulllog is sized from input but written bounded by OSMAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a...

CVE-2026-88071: Double Free

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally...

CVE-2026-70113: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally...

CVE-2026-70217: Improper Access Control

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-70143: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally...

CVE-2026-70139: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69926: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in Desktop Window Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-108488: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

CVE-2026-70056: Use After Free

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70147: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-97768: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

CVE-2026-69957: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-63159: Weak Password Recovery Mechanism for Forgotten Password

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-97815: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network...

CVE-2026-70260: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...

CVE-2026-85361: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-83965: Stack-based Buffer Overflow

Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-110208: Missing Authorization

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

CVE-2026-96313: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-96218: External Control of System or Configuration Setting

Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally...

CVE-2026-87696: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-96113: Heap-based Buffer Overflow

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network...

CVE-2026-96305: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-88103: Use After Free

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-96324: Use After Free

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-96247: Use of Uninitialized Resource

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally...

CVE-2026-97803: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-96220: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Windows Assigned Access allows an authorized attacker to elevate privileges locally...