2026

Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges lo

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Servic

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams fo

Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature l

Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges loca

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, s

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly check

Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Mana

Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacke

Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer derefere

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decr

Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the who

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenS

Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes f

Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the S

Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an autho

Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted reque

DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_requ

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges loca

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing P

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the ciphe

Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Base

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes

Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service all

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended websit

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A succes

NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A succes

Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which co

Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows u

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local n

Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected

An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated admini

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated a