422 CVEs tracked today. 34 Critical, 216 High, 149 Medium, 23 Low.
-
CVE-2026-40887
CRITICAL
CVSS 9.1
## Summary
An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affe...
SQLi
PostgreSQL
-
CVE-2026-40884
CRITICAL
CVSS 9.8
### Summary
goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with `-b ':pass'` together with `-sftp`, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated ne...
Authentication Bypass
-
CVE-2026-40313
CRITICAL
CVSS 9.1
GitHub Actions credential leakage in PraisonAI through ArtiPACKED attack exposes GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN in workflow artifacts. Versions 4.5.139 and below persist credentials in .git/config via actions/checkout without disabling persist-credentials, allowing any user with read access to public repository artifacts to extract tokens and compromise the supply chain. CVSS 9.1 (Critical) with network-accessible, unauthenticated attack vector. EPSS data not provided; no confirmed active exploitation (KEV status not indicated), but attack technique is publicly documented by Palo Alto Unit42 and widely reported. Vendor-released patch available in version 4.5.140.
Information Disclosure
Docker
-
CVE-2026-40289
CRITICAL
CVSS 9.1
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140) allows network attackers to control browser automation sessions without authentication. The /ws WebSocket endpoint accepts connections from any client omitting the Origin header, enabling attackers to send start_session commands that hijack idle browser-extension sessions and receive all automation outputs. With CVSS 9.1 (Critical) scoring driven by network attack vector, low complexity, and no authentication requirement (AV:N/AC:L/PR:N), this represents a severe risk in any deployment where the default 0.0.0.0 binding exposes the service to untrusted networks. No public exploit identified at time of analysis, though exploitation requires only basic WebSocket client capabilities.
Authentication Bypass
-
CVE-2026-40288
CRITICAL
CVSS 9.8
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) allows remote unauthenticated attackers to execute shell commands and Python code through malicious YAML workflow files. The vulnerability stems from unsafe processing of 'run:', 'script:', and 'python:' directives in job-type workflows without validation or sandboxing. With a critical CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interac
RCE
Python
Command Injection
-
CVE-2026-39842
CRITICAL
CVSS 9.9
Remote code execution as root in OpenRemote IoT platform's rules engine (versions prior to 1.20.3) allows authenticated non-superuser attackers with write:rules role to execute arbitrary Java code via unsandboxed JavaScript rulesets. The vulnerability stems from Nashorn ScriptEngine.eval() executing user-supplied JavaScript without ClassFilter restrictions, enabling Java.type() access to any JVM class including java.lang.Runtime. Attackers can compromise the entire multi-tenant platform, steal c
RCE
Java
Information Disclosure
Docker
PostgreSQL
-
CVE-2026-39813
CRITICAL
CVSS 9.8
Path traversal in Fortinet FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 enables remote unauthenticated attackers to achieve full system compromise. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), the vulnerability permits network-based exploitation without credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. Despite critical severity, EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC framework marks it as automatable with total technical impact but no current exploitation. The incomplete CVE description (placeholder text for attack vector) suggests early disclosure; verify completeness with Fortinet advisory FG-IR-26-112.
Privilege Escalation
Path Traversal
Fortinet
-
CVE-2026-39808
CRITICAL
CVSS 9.8
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauthenticated attackers to execute arbitrary system commands with complete system compromise. CVSS 9.8 (network, low complexity, no privileges) but EPSS 0.29% (53rd percentile) suggests limited real-world exploitation observed despite maximum severity score. No active exploitation confirmed (not in CISA KEV). SSVC framework classifies as automatable with total technical impact but no known exploitation. Fortinet PSIRT advisory FG-IR-26-100 available but description incomplete (missing attack vector specifics).
Fortinet
Command Injection
-
CVE-2026-39399
CRITICAL
CVSS 9.6
Cross-package metadata injection in NuGet Gallery backend allows authenticated attackers to achieve remote code execution and arbitrary blob storage writes through crafted .nuspec files. Attackers exploit URI fragment injection via unsanitized package identifiers to control blob paths in the storage container, enabling tampering of existing content beyond .nupkg files. CVSS 9.6 (Critical) with network attack vector, low complexity, and scope change. Vendor-released patch available in commit 0e80f87628349207cdcaf55358491f8a6f1ca276. No public exploit identified at time of analysis.
RCE
-
CVE-2026-38526
CRITICAL
CVSS 9.9
Remote code execution in Webkul Krayin CRM v2.2.x allows authenticated attackers with low-level privileges to upload and execute malicious PHP files through an unrestricted file upload vulnerability in the /admin/tinymce/upload endpoint. The scope change (CVSS S:C) indicates potential container escape or cross-tenant impact. Authentication requirement confirmed (CVSS PR:L). No public exploit identified at time of analysis, though technical details are available in security advisory references.
PHP
RCE
File Upload
-
CVE-2026-35033
CRITICAL
CVSS 9.3
Arbitrary file read via ffmpeg argument injection in Jellyfin media server versions before 10.11.7 allows unauthenticated remote attackers to exfiltrate sensitive server files (including /etc/shadow) through malicious StreamOptions query parameters. The vulnerability bypasses input validation by exploiting the ParseStreamOptions method, which concatenates unsanitized lowercase query parameters directly into ffmpeg command lines, enabling drawtext filter injection to render file contents in video streams. CVSS 9.3 (Critical) with network attack vector and no authentication required. No public exploit identified at time of analysis, though the technical details in the advisory provide a clear exploitation path.
Authentication Bypass
-
CVE-2026-35031
CRITICAL
CVSS 9.9
Remote code execution as root in Jellyfin media server versions prior to 10.11.7 allows authenticated users with 'Upload Subtitles' permission to execute arbitrary code through a multi-stage attack chain exploiting path traversal in subtitle uploads, arbitrary file write, and ld.so.preload manipulation. CVSS 9.9 (Critical) reflects the complete system compromise potential. EPSS data not available. Not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. Attack requires low-privilege authenticated access but can escalate to full root-level code execution.
Privilege Escalation
RCE
Path Traversal
-
CVE-2026-34615
CRITICAL
CVSS 9.3
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. Adobe issued patch APSB26-37. EPSS indicates 81st percentile risk with 1.44% probability, and CISA SSVC reports no active exploitation. The CVSS vector conflicts with the description: vector indicates user interaction required (UI:R) while description states 'does not require user interaction' - verify actual interaction requirements with Adobe advisory.
RCE
Deserialization
Adobe
-
CVE-2026-34457
CRITICAL
CVSS 9.1
Authentication bypass in OAuth2 Proxy versions before 7.15.2 allows remote unauthenticated attackers to access protected resources when deployed with nginx auth_request integration and health check features enabled. Attackers can spoof health check User-Agent headers to bypass OAuth2 authentication entirely, gaining unauthorized access to upstream applications. CVSS 9.1 (Critical) reflects network-accessible, low-complexity attack requiring no privileges or user interaction. No active exploitation confirmed (not in CISA KEV), but the trivial attack complexity and authentication bypass impact warrant immediate patching in affected deployments using nginx auth_request with --ping-user-agent or --gcp-healthchecks flags.
Authentication Bypass
Nginx
-
CVE-2026-33825
HIGH
CVSS 7.8
Privilege escalation in Microsoft Defender Antimalware Platform versions before 4.18.26030.3011 allows authenticated local attackers to gain elevated system privileges through insufficiently granular access controls. CVSS 7.8 (High) reflects local attack vector requiring low privileges. EPSS score of 0.04% (12th percentile) indicates low probability of widespread exploitation. Microsoft has released a patched version (4.18.26030.3011) addressing the access control deficiency.
Information Disclosure
Microsoft
-
CVE-2026-33824
CRITICAL
CVSS 9.8
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthenticated network attackers to execute arbitrary code on Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025). CVSS 9.8 critical severity with network vector requiring no authentication or user interaction. Vendor patch released by Microsoft addresses CWE-415 double free weakness. EPSS score of 0.07% (21st percentile) suggests low observed exploitation probability despite critical severity rating, indicating this may be a targeted or difficult-to-exploit vulnerability in production environments. No CISA KEV listing or public POC identified at time of analysis.
Authentication Bypass
Microsoft
-
CVE-2026-32202
MEDIUM
CVSS 4.3
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a network without authentication, requiring only user interaction. This low-severity vulnerability affects multiple Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. While not actively exploited in the wild, vendor patches are available across all affected versions, and the low CVSS score (4.3) reflects limited confidentiality impact and no availability impact despite the network-accessible attack vector.
Authentication Bypass
Microsoft
-
CVE-2026-32201
MEDIUM
CVSS 6.5
Improper input validation in Microsoft SharePoint Server enables network-based spoofing attacks without authentication, allowing attackers to forge communications and deceive users. Affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, making it a critical operational priority despite the moderate CVSS score of 6.5.
Authentication Bypass
Microsoft
-
CVE-2026-31908
CRITICAL
CVSS 9.1
Header injection vulnerability in Apache APISIX.
The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.
This issue affects Apache APISIX: from 2.12.0 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Apache
Code Injection
-
CVE-2026-31049
CRITICAL
CVSS 9.8
An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field
RCE
-
CVE-2026-27681
CRITICAL
CVSS 9.9
SQL injection in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW) allows authenticated users to execute arbitrary SQL commands against the database. Affected versions span SAP_BW 750-758, BPC4HANA 300, and HANABPC 810/816. The scope-change vector (S:C) indicates attackers can pivot beyond the vulnerable component to compromise database resources serving multiple SAP applications. Despite critical CVSS 9.9 severity, EPSS exploitation probability remains low (0.05%, 14th percentile) with CISA SSVC indicating no current exploitation and non-automatable attack profile. SAP security note 3719353 provides remediation guidance.
SQLi
SAP
-
CVE-2026-27304
CRITICAL
CVSS 9.3
Remote code execution in Adobe ColdFusion 2023.18, 2025.6 and earlier allows unauthenticated adjacent network attackers to execute arbitrary code via improper input validation. The vulnerability requires no user interaction and achieves scope change, enabling attackers to break out of security boundaries. CVSS 9.3 (Critical). No confirmed active exploitation or public POC identified at time of analysis, but the combination of zero authentication requirements and code execution impact makes this a high-priority patching target for ColdFusion deployments.
RCE
-
CVE-2026-27303
CRITICAL
CVSS 9.6
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization. Attack requires no user interaction despite UI:R in CVSS vector, with scope change enabling container escape or privilege escalation beyond the application context. Adobe released patch APSB26-37. EPSS score of 1.50% (81st percentile) indicates moderate exploitation probability. No active exploitation confirmed (SSVC: exploitation=none), but deserialization flaws are commonly targeted once details emerge.
RCE
Deserialization
Adobe
-
CVE-2026-27246
CRITICAL
CVSS 9.3
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim browsers when users visit attacker-crafted webpages. The changed scope in CVSS vector (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security authority, potentially allowing lateral access to other Connect features or sessions. Adobe has released a patch in APSB26-37. EPSS exploitation probability is low (0.10%, 27th percentile) with no confirmed active exploitation (not in CISA KEV), suggesting this is currently a theoretical risk rather than an imminent mass-exploitation threat.
XSS
Adobe
-
CVE-2026-27245
CRITICAL
CVSS 9.3
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) indicates potential escape from Adobe Connect's application context to access other origins, elevating impact beyond typical reflected XSS. CVSS 9.3 reflects high confidentiality/integrity impact with scope change, though real-world exploitation requires social engineering (UI:R). EPSS score of 0.10% (27th percentile) and SSVC classification of non-automatable with no observed exploitation suggest this is lower priority than CVSS alone indicates, despite the high numerical score.
XSS
Adobe
-
CVE-2026-27243
CRITICAL
CVSS 9.3
Reflected XSS in Adobe Connect versions 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component, elevating the severity to 9.3 despite being 'just' XSS. Requires user interaction (clicking malicious link) but no authentication. EPSS score of 0.10% (27th percentile) suggests low probability of mass exploitation. CISA SSVC framework rates this as non-automatable with total technical impact but no observed exploitation, indicating priority for patch deployment in internet-facing Adobe Connect deployments but not emergency response level.
XSS
Adobe
-
CVE-2026-26149
CRITICAL
CVSS 9.0
Escape sequence injection in Microsoft Power Apps versions prior to 3.26032.10.0 allows authenticated attackers with low privileges to bypass security controls and achieve remote code execution with high confidentiality, integrity, and availability impact across security boundaries. The vulnerability requires user interaction and affects Power Apps 1710 (build 9.2.23071.136 and earlier). EPSS score of 0.08% (23rd percentile) suggests low probability of mass exploitation despite critical CVSS 9.0 rating. Vendor patch available via Microsoft Security Response Center advisory.
Authentication Bypass
Microsoft
-
CVE-2026-6264
CRITICAL
CVSS 9.8
Unauthenticated remote code execution via JMX monitoring port affects Talend JobServer and Talend Runtime (CVSS 9.8). Attackers can exploit the exposed JMX interface without authentication to execute arbitrary code with JobServer privileges. Vendor-released patches available (Talend ESB Runtime R2024-07-RT). No confirmed active exploitation (CISA KEV status: NO), but the trivial attack complexity (AC:L) and network accessibility (AV:N) present significant risk for exposed instances. EPSS data not provided.
RCE
-
CVE-2026-5752
CRITICAL
CVSS 9.3
Sandbox escape in Terrarium enables arbitrary code execution with root privileges on the host system through JavaScript prototype chain traversal. This local attack requires no authentication or user interaction and breaks out of the sandbox entirely (scope change from container to host). CERT/CC publicly disclosed the vulnerability (VU#414811). EPSS probability is very low at 0.02% (5th percentile), and CISA SSVC indicates no active exploitation detected. Despite the critical 9.3 CVSS score, real-world risk appears limited by local attack vector and absence of widespread targeting, though the total technical impact (root-level host compromise) makes this severe for any deployment running untrusted code in Terrarium sandboxes.
RCE
-
CVE-2026-4365
CRITICAL
CVSS 9.1
Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete arbitrary quiz answer options without authentication. The plugin exposes wp_rest nonces to unauthenticated visitors in public frontend HTML and uses this nonce as the sole security gate for its AJAX dispatcher, while the delete_question_answer() function lacks both capability and ownership verification. With CVSS 9.1 (Critical) scoring and network-exploitable attack vector requi
WordPress
Authentication Bypass
-
CVE-2026-2449
CRITICAL
CVSS 9.0
Argument injection in upKeeper Instant Privilege Access through version 1.5.0 enables remote authenticated attackers to hijack privileged execution threads via manipulated command delimiters. The network-accessible attack vector combined with high confidentiality, integrity, and availability impacts across both vulnerable and subsequent systems creates critical risk for privilege escalation scenarios. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though vendor self-disclosure suggests potential for targeted abuse.
Code Injection
-
CVE-2025-70023
CRITICAL
CVSS 9.8
An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.
Information Disclosure
Memory Corruption
-
CVE-2025-65135
CRITICAL
CVSS 9.8
Time-based blind SQL injection in manikandan580 School Management System 1.0 allows unauthenticated remote attackers to extract sensitive database contents and potentially execute arbitrary SQL commands through the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php. The CVSS 9.8 critical score reflects network-based exploitation requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the specific vulnerable parameter and injection type are documented in public security advisories.
PHP
SQLi
-
CVE-2025-65133
CRITICAL
CVSS 9.8
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database information.
SQLi
-
CVE-2025-63939
CRITICAL
CVSS 9.8
SQL injection in Grocery Store Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands through the sitem_name parameter in search_products_itname.php. The vulnerability achieves maximum CVSS 9.8 due to network accessibility without authentication, enabling complete database compromise including data exfiltration, modification, and potential system takeover. EPSS data not available; no confirmed active exploitation (CISA KEV) identified at time of analysis, though publicly available exploit code exists per researcher advisory.
PHP
SQLi
-
CVE-2025-61260
CRITICAL
CVSS 9.8
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads pro...
RCE
Code Injection
-
CVE-2025-8095
CRITICAL
CVSS 9.1
Progress OpenEdge 12.2.0-12.2.18 and 12.8.0-12.8.9 expose stored passwords and secrets to decryption through cryptographically weak OECH1 prefix encoding. Remote unauthenticated attackers can exploit this weakness to recover obfuscated credentials and sensitive data (CVSS 9.1, VC:H/VI:H). No public exploit identified at time of analysis, but the vulnerability is automatable with total technical impact per SSVC framework, making credential harvesting straightforward once encoding is accessed.
Information Disclosure
-
CVE-2026-40890
HIGH
CVSS 7.5
### Summary
Processing a malformed input containing a `<` character that is not followed by a `>` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.
### Details
The `smartLeftAngle()` function in `html/smartypants.go:367-376` performs a...
Buffer Overflow
Denial Of Service
Information Disclosure
Red Hat
-
CVE-2026-40885
HIGH
CVSS 7.7
### Summary
goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to `.goshs`-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including ...
Authentication Bypass
Information Disclosure
-
CVE-2026-40876
HIGH
CVSS 8.7
Authenticated SFTP users in goshs (a Go-based HTTP/SFTP file server) can read and write files outside the configured SFTP root directory via a path validation bypass. The vulnerability affects the SFTP subsystem in goshs beta.4 and earlier v2.x versions, exploiting a flawed string-prefix check that treats sibling directories (e.g., /tmp/goshsroot_evil) as valid when the configured root is /tmp/goshsroot. Public exploit code exists with video demonstrations showing complete jail escape, allowing authenticated attackers to list directories, download sensitive files, create arbitrary directories, and upload malicious content outside the intended boundary. Fix released in goshs v2.0.0 per vendor advisory GHSA-5h6h-7rc9-3824.
Path Traversal
File Upload
-
CVE-2026-40870
HIGH
CVSS 7.5
Decidim GraphQL API exposes all commentable resources platform-wide without permission checks, enabling unauthorized access to comments and associated data across public and private participation spaces. Affects decidim-api and decidim-comments Ruby gems with default configurations exposing the /api endpoint publicly. No vendor patch available - only workarounds via authentication enforcement or IP allowlisting. CVSS 7.5 (High) reflects network-accessible confidentiality breach, though real-world impact depends heavily on whether the Decidim instance hosts non-public participation spaces.
Authentication Bypass
Nginx
-
CVE-2026-40869
HIGH
CVSS 7.5
Authorization bypass in Decidim Core allows any authenticated user to accept or reject amendments on proposals belonging to other users, effectively hijacking proposal authorship. Affects decidim-core gem versions 0.19.0 and later. The flaw stems from insufficient permission checks (CWE-266) that only verify if amendment reactions are enabled at the component level, not whether the user owns the proposal. CVSS 7.5 (High) reflects network-based integrity impact, though the PR:N (no privileges required) rating appears inconsistent with the description stating 'registered and authenticated user' - this discrepancy should be verified with the vendor. No patch version identified in available data; vendor advisory recommends disabling amendment reactions as a workaround. No active exploitation (CISA KEV) or public POC reported at time of analysis.
Information Disclosure
-
CVE-2026-40868
HIGH
CVSS 8.1
Kyverno's apiCall service helper automatically injects the controller's ServiceAccount token into HTTP requests when ClusterPolicy or GlobalContextEntry authors omit an Authorization header, enabling token exfiltration to attacker-controlled endpoints via confused deputy vulnerability. Affects deployments where policy YAML repositories are compromised (GitOps threat model) or ClusterPolicy creation is possible. CVSS 8.1 (High) reflects network attack vector with low complexity and low privileges required. No CISA KEV listing or public exploit identified at time of analysis, but GitHub advisory includes working proof-of-concept demonstrating token injection and exfiltration.
Kubernetes
Code Injection
Canonical
-
CVE-2026-40688
HIGH
CVSS 7.2
Out-of-bounds write in FortiWeb administrative interface enables authenticated remote code execution on web application firewall appliances. Affects FortiWeb 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.3. CVSS 7.2 indicates high-privilege authenticated network attack with low complexity. No public exploit identified at time of analysis, though the incomplete advisory description ('<insert attack vector here>') suggests disclosure may be pending or sanitized. Memory corruption class (CWE-787) typically enables arbitrary code execution, confirmed by CVSS impact ratings (High C/I/A). EPSS data not available for risk probability assessment.
Buffer Overflow
Fortinet
Memory Corruption
-
CVE-2026-40683
HIGH
CVSS 7.7
OpenStack Keystone's LDAP identity backend grants authentication access to disabled user accounts due to improper string-to-boolean conversion logic. Versions 8.0.0 through 28.0.0 fail to convert LDAP-disabled status into boolean values when user_enabled_invert is False (default), causing disabled accounts to authenticate as enabled. This affects all LDAP-backed Keystone deployments without specific configuration overrides. CVSS 7.7 with changed scope (S:C) indicates potential cross-tenant privilege issues. EPSS data not available; no public exploit identified at time of analysis, though the logic flaw is straightforward to trigger with valid low-privilege credentials.
Python
Information Disclosure
Memory Corruption
Red Hat
-
CVE-2026-40323
HIGH
CVSS 8.9
Soundness violation in SP1 V6 recursive proof verifier enables malicious provers to construct recursive proofs from invalid shard proofs that native verifiers would reject. The vulnerability affects SP1 zkVM versions 6.0.0 through 6.0.2 (Rust crates sp1_sdk, sp1_recursion_circuit, sp1_prover) and allows forgery of zero-knowledge proofs by exploiting missing consistency checks between commitment-side and evaluation-side trace shape witnesses in the jagged PCS verifier circuit. This permits misrepresentation of circuit structure itself, not just data, undermining the fundamental soundness guarantees of the proof system. No public exploit exists at time of analysis, though the vulnerability was identified through SP1's bug bounty program on Code4rena. CVSS 8.9 reflects high integrity impact to both vulnerable and subsequent system components.
Denial Of Service
-
CVE-2026-40315
HIGH
CVSS 7.2
SQL identifier injection in PraisonAI's SQLiteConversationStore allows authenticated local attackers with configuration control to extract database schema and manipulate query results. The vulnerability affects PraisonAI versions prior to 4.5.133, where unsanitized table_prefix values are concatenated into SQL queries via f-strings. Attackers controlling configuration inputs (from_yaml/from_dict) can inject SQL fragments to access internal SQLite tables like sqlite_master and execute UNION-based injections. A vendor patch is available in version 4.5.133. No public exploit code or active exploitation confirmed at time of analysis. CVSS 7.2 indicates local attack vector with low complexity but requires low privileges and present attack complexity conditions.
SQLi
-
CVE-2026-40291
HIGH
CVSS 8.8
Privilege escalation in Chamilo LMS versions prior to 2.0.0-RC.3 allows authenticated students to gain full administrative access via API manipulation. Low-privilege users (ROLE_STUDENT) can modify their own user record through the PUT /api/users/{id} endpoint to assign themselves ROLE_ADMIN privileges, bypassing intended access controls. The vulnerability stems from inadequate authorization checks that verify only record ownership without restricting modification of security-critical fields. With CVSS 8.8 (High) and low attack complexity requiring only basic authentication, this represents a critical access control failure in educational platforms. No public exploit code or active exploitation (CISA KEV) identified at time of analysis, though the straightforward attack vector makes exploitation trivial for malicious insiders.
Privilege Escalation
-
CVE-2026-40287
HIGH
CVSS 8.4
Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported from the current working directory without validation. Attackers placing a crafted tools.py in shared projects, cloned repositories, or writable workspaces achieve immediate code execution with full process privileges upon PraisonAI startup. EPSS data not available, but the local attack vector (AV:L) requiring no privileges (PR:N) or user interaction (UI:N) enables exploitation through supply chain and workspace poisoning attacks. No public exploit identified at time of analysis, though the vulnerability is trivial to exploit given the straightforward code injection mechanism.
RCE
Python
Code Injection
-
CVE-2026-40261
HIGH
CVSS 8.8
Command injection in Composer's Perforce integration allows remote code execution when installing packages from malicious repositories. The vulnerability exists in versions before 2.2.27 and 2.9.6, affecting all users who install dependencies from source (--prefer-source or dev versions) regardless of whether Perforce is installed. Attackers can inject shell commands through crafted source references or connection parameters in package metadata served by compromised Composer repositories. CVSS 8.8 (High) with network attack vector, low complexity, and no authentication required (though user interaction is needed). No confirmed active exploitation (CISA KEV), but publicly available exploit code exists per GitHub advisory disclosure.
Command Injection
-
CVE-2026-40248
HIGH
CVSS 8.7
Unauthenticated attackers with network access to the free5GC UDR service's 5G Service Based Interface can create or overwrite Traffic Influence Subscriptions due to missing return statement after path validation. The vulnerability affects free5GC UDR versions prior to the patch (commit in GHSA-jgq2-qv8v-5cmj), allowing arbitrary subscription injection with attacker-controlled notification URIs and SUPI values while receiving misleading 404 responses. Public exploit code exists in the form of a d
Authentication Bypass
-
CVE-2026-40247
HIGH
CVSS 8.7
Unauthenticated information disclosure in free5GC UDR service allows remote attackers to retrieve sensitive Traffic Influence Subscription data through improper path validation. Due to a missing return statement after sending HTTP 404 responses, attackers can read subscription records containing subscriber IMSIs, network slice identifiers, and callback URIs without authentication by supplying arbitrary path values. EPSS score of 0.06% suggests low widespread exploitation probability, though the vulnerability requires only network access to the 5G Service Based Interface with no authentication or user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists in the original disclosure.
Authentication Bypass
Information Disclosure
-
CVE-2026-40246
HIGH
CVSS 8.7
Unauthenticated deletion of Traffic Influence Subscriptions in free5GC UDR service (GitHub package free5gc/udr) allows remote attackers to disrupt 5G policy notification workflows by exploiting a missing return statement after path validation. The vulnerability affects any free5GC deployment where the 5G Service Based Interface (SBI) is network-accessible to untrusted parties. Public exploit code exists demonstrating deletion via crafted DELETE requests to invalid API paths. EPSS score of 0.06% (19th percentile) suggests low widespread exploitation probability, though the attack requires only network access and no authentication (AV:N/PR:N), making it trivially exploitable in misconfigured deployments.
Authentication Bypass
-
CVE-2026-40245
HIGH
CVSS 7.5
Unauthenticated access to free5GC UDR subscriber identifiers exposes SUPI/IMSI values via unprotected 5G Service Based Interface endpoint. Missing return statements in free5GC UDR versions prior to 4.2.1 allow attackers to retrieve complete subscriber databases with a single parameterless HTTP GET request, undermining 3GPP SUCI privacy mechanisms. Public exploit code exists. EPSS score is low (0.10%) indicating limited observed exploitation, but impact is severe for exposed deployments with misconfigured network segmentation.
Information Disclosure
Deserialization
-
CVE-2026-40176
HIGH
CVSS 7.8
Command injection in Composer's Perforce integration allows arbitrary code execution when processing malicious composer.json files. Attackers controlling VCS repository configuration can inject shell commands via unsanitized Perforce connection parameters (port, user, client), which execute even without Perforce installed. CVSS 7.8 (High) with local attack vector requiring user interaction. Affects Composer versions before 2.2.27 and 2.9.6. Exploitation requires victim to run Composer commands on attacker-controlled project root composer.json, limiting scope to supply chain or social engineering scenarios. No KEV listing or public POC identified at time of analysis, but exploitation barrier is low once malicious config is introduced.
Command Injection
-
CVE-2026-40164
HIGH
CVSS 7.5
Algorithmic complexity attack in jq JSON processor allows remote denial of service via hash collision exploitation. An attacker can craft a ~100KB JSON object with precomputed colliding keys that degrade hash table performance from O(1) to O(n²), causing severe CPU exhaustion in unauthenticated network contexts including CI/CD pipelines and web services. The vulnerability stems from a hardcoded MurmurHash3 seed (0x432A9843) that enables offline collision calculation. Fixed in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. CVSS 7.5 (High severity, network-exploitable, no authentication required). No public exploit identified at time of analysis, but attack technique is well-documented and feasible.
Buffer Overflow
-
CVE-2026-40090
HIGH
CVSS 7.1
Path traversal in Zarf package inspection commands enables arbitrary file write when processing malicious packages. Attackers can craft Zarf packages with traversal sequences in the Metadata.Name field (e.g., '../../etc/cron.d/malicious'), bypassing input validation to write attacker-controlled content to sensitive system locations when users run 'zarf package inspect sbom' or 'zarf package inspect documentation'. Fixed in version v0.74.2. CVSS 7.1 (High) with network attack vector but requires user interaction. No public exploit identified at time of analysis, though exploitation complexity is low as attackers only need to modify zarf.yaml and sboms.tar in a package archive.
Path Traversal
-
CVE-2026-39971
HIGH
CVSS 7.2
SMTP header injection in Serendipity CMS allows remote unauthenticated attackers to inject arbitrary email headers via malicious Host header during email-triggering operations (comments, subscriptions, password resets). The unsanitized $_SERVER['HTTP_HOST'] value is embedded directly into Message-ID headers without validation, enabling BCC injection, email spoofing, and reply hijacking. CVSS 7.2 with Changed scope indicates cross-domain impact. EPSS data not available; no public exploit identified at time of analysis, though a detailed proof-of-concept exists in the GitHub security advisory demonstrating successful header injection via comment submission.
PHP
RCE
-
CVE-2026-39907
HIGH
CVSS 7.0
Unisys WebPerfect Image Suite 3.0.3960.22810 and 3.0.3960.22604 leak NTLMv2 machine-account hashes through an unauthenticated SOAP endpoint on TCP port 1208, enabling remote attackers to force SMB authentication attempts and relay credentials for privilege escalation or lateral movement. The WCF service accepts unsanitized file paths in the ReadLicense action, allowing UNC path injection to trigger outbound SMB connections. CVSS 7.0 with network attack vector, low complexity, and no authentication required (PR:N). No public exploit code identified at time of analysis, though the attack technique is straightforward for adversaries familiar with NTLM relay tactics.
Privilege Escalation
-
CVE-2026-39906
HIGH
CVSS 7.0
NTLMv2 credential leakage in Unisys WebPerfect Image Suite 3.0.3960.22810 and 3.0.3960.22604 enables remote unauthenticated attackers to extract machine-account hashes via deprecated .NET Remoting TCP channels, facilitating network-wide lateral movement and privilege escalation through hash relay attacks. Disclosed by VulnCheck, this flaw exploits insecure object deserialization to coerce NTLM authentication to attacker-controlled UNC paths. EPSS data not available; no KEV listing or public exploit code identified at time of analysis, though the disclosed technical details provide sufficient information for weaponization.
Privilege Escalation
Microsoft
-
CVE-2026-39884
HIGH
CVSS 8.3
Command injection in mcp-server-kubernetes port_forward function allows authenticated network attackers to expose internal Kubernetes services to external networks or bypass namespace restrictions. The vulnerability (CVSS 8.3) stems from unsafe string concatenation and space-splitting of kubectl arguments, enabling arbitrary flag injection via fields like resourceName or namespace. Attackers can inject '--address=0.0.0.0' to bind port-forwards on all network interfaces, exposing databases and internal APIs beyond localhost. Affects mcp-server-kubernetes <= 3.4.0. No public exploit identified at time of analysis, though exploitation requires only low complexity (AC:L) with authenticated access (PR:L).
RCE
Kubernetes
-
CVE-2026-39815
HIGH
CVSS 8.8
SQL injection in Fortinet FortiDDoS-F 7.2.1-7.2.2 allows authenticated remote attackers to execute unauthorized code or commands with high impact to confidentiality, integrity, and availability. The vulnerability resides in the web management interface and requires low attack complexity with no user interaction. No public exploit identified at time of analysis, with EPSS data not yet available for this recently disclosed CVE.
Fortinet
SQLi
-
CVE-2026-39387
HIGH
CVSS 7.2
Local File Inclusion in BoidCMS versions prior to 2.1.3 enables authenticated administrators to execute arbitrary PHP code via path traversal in the tpl parameter combined with file upload. The vulnerability chains unsanitized require_once() inclusion with media upload functionality, allowing attackers to upload malicious files and force their execution with web server privileges. Vendor-released patch available in version 2.1.3. CVSS 7.2 reflects high-privilege requirement (administrator access), but exploitation complexity is low once authenticated. No CISA KEV listing or public exploit code identified at time of analysis.
PHP
RCE
Path Traversal
LFI
File Upload
-
CVE-2026-38532
HIGH
CVSS 8.1
Broken Object-Level Authorization in Webkul Krayin CRM v2.2.x allows authenticated attackers to access, modify, and delete contact records belonging to other users without authorization. The vulnerability exists in the PersonController.php endpoint where insufficient access controls permit low-privileged authenticated users to manipulate arbitrary contact objects via crafted GET requests. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity (CVSS:3.1 AV:N/AC:L/PR:L).
PHP
Authentication Bypass
-
CVE-2026-38530
HIGH
CVSS 8.1
Broken Object-Level Authorization in Webkul Krayin CRM 2.2.x allows authenticated attackers to read, modify, and permanently delete leads belonging to other users via crafted GET requests to the LeadController endpoint. This multi-tenant access control failure enables horizontal privilege escalation across customer boundaries. Authentication requirements are minimal (PR:L in CVSS vector), and the attack complexity is low with no user interaction required. No public exploit identified at time of analysis, though the vulnerability appears straightforward to exploit given its BOLA nature.
PHP
Authentication Bypass
-
CVE-2026-38529
HIGH
CVSS 8.8
Authenticated attackers can reset arbitrary user passwords in Webkul Krayin CRM v2.2.x through a Broken Object-Level Authorization (BOLA) vulnerability in the /Settings/UserController.php endpoint, enabling full account takeover of any user account. The attack requires low-privilege authentication (PR:L) and is exploitable remotely with low complexity (AV:N/AC:L), presenting an 8.8 CVSS severity with high impact to confidentiality, integrity, and availability. EPSS data not available; no CISA KEV listing identified; publicly available exploit code exists per researcher disclosure.
PHP
Privilege Escalation
-
CVE-2026-38528
HIGH
CVSS 7.1
SQL injection in Krayin CRM 2.2.x allows authenticated remote attackers to extract sensitive database contents via the rotten_lead parameter in LeadDataGrid.php. CVSS 7.1 severity with network attack vector and low complexity enables database enumeration with low-privilege credentials. No public exploit identified at time of analysis, though EPSS data unavailable. Technical advisory published on GitHub indicates vulnerability affects lead management functionality in this Laravel-based open-source CRM platform.
PHP
SQLi
-
CVE-2026-38527
HIGH
CVSS 8.5
Server-Side Request Forgery in Webkul Krayin CRM 2.2.x enables authenticated users to scan internal network resources and access sensitive information through the webhook creation endpoint. Attackers with low-privilege accounts can send crafted POST requests to /settings/webhooks/create, forcing the server to make requests to arbitrary internal URLs. With CVSS 8.5 (High) and scope change to other components, this allows reconnaissance of internal infrastructure, access to cloud metadata endpoints, and potential lateral movement. EPSS data not available; no public exploit identified at time of analysis, though technical details are published in security advisory.
SSRF
-
CVE-2026-35589
HIGH
CVSS 8.0
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establish unauthorized WebSocket connections to the local bridge server (ws://127.0.0.1:3001/), enabling WhatsApp session hijacking, message interception, QR code theft, and unauthorized message transmission. This vulnerability stems from incomplete remediation of CVE-2026-2577, where the added BRIDGE_TOKEN authentication is disabled by default and the server fails to validate the Origin header during WebSocket handshakes. Attack complexity is high (AC:H) but requires no authentication (PR:N), only user interaction (UI:R) such as visiting a malicious website while the bridge is running. No public exploit identified at time of analysis, though the technical details are fully disclosed in GitHub security advisory GHSA-v5j3-4q66-58cf.
Information Disclosure
-
CVE-2026-35196
HIGH
CVSS 8.8
OS command injection in Chamilo LMS prior to 2.0.0-RC.3 allows authenticated attackers to execute arbitrary system commands via session poisoning of the course ID parameter. Attackers with low-privilege accounts can manipulate the $_SESSION['_cid'] variable to inject shell metacharacters into shell_exec() calls in the gradebook certificate export functionality, achieving full system compromise. CVSS 8.8 (High) with network attack vector and low complexity. No public exploit identified at time of analysis, though technical details are disclosed in the GitHub advisory. EPSS data not available for this recent CVE.
PHP
Command Injection
-
CVE-2026-35032
HIGH
CVSS 8.6
Jellyfin media server versions before 10.11.7 allow authenticated users to escalate privileges to administrator through a chained exploit involving M3U tuner SSRF, local file read, and database exfiltration. Any authenticated user can exploit this because the EnableLiveTvManagement permission defaults to enabled. The attack chain enables reading the Jellyfin database to extract admin session tokens, achieving full administrative control. CVSS 8.6 (High) reflects network-accessible attack requiring only low-privilege authentication. No active exploitation (CISA KEV) confirmed, but public disclosure via GitHub Security Advisory indicates exploit details are known.
SSRF
-
CVE-2026-34631
HIGH
CVSS 7.8
Arbitrary code execution in Adobe InCopy 20.5.2, 21.2 and earlier allows unauthenticated local attackers to execute malicious code with the victim's privileges through a specially crafted file. The vulnerability stems from an out-of-bounds write (CWE-787) triggering memory corruption. Exploitation requires the victim to open a malicious document, making this a viable social engineering vector. No public exploit identified at time of analysis, though the vulnerability's local attack vector and user interaction requirement moderately constrain immediate risk.
RCE
Buffer Overflow
Memory Corruption
-
CVE-2026-34630
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe Bridge 16.0.2, 15.1.4, and earlier versions enables arbitrary code execution with victim's privileges when processing maliciously crafted files. Attack requires local access and user interaction (opening a weaponized file). CVSS 7.8 (High) reflects significant impact but local-only attack vector. No public exploit identified at time of analysis, and exploitation probability remains moderate given the user interaction requirement and local access constraint.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-34629
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution with high integrity and confidentiality impact when users open specially crafted malicious files. No public exploit identified at time of analysis. CVSS 7.8 reflects local attack vector requiring user interaction but no authentication, with complete system compromise potential in user context. EPSS risk data not available; exploitation requires social engineering to deliver malicious InDesign document.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-34628
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution with high impact to confidentiality, integrity, and availability when users open malicious files. The vulnerability requires local access and user interaction (opening a crafted document), with no authentication barriers (CVSS PR:N). No public exploit identified at time of analysis, and CISA SSVC framework rates this as non-exploited with total technical impact but not automatable, indicating targeted attack potential rather than mass exploitation risk.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-34627
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution with high confidentiality, integrity, and availability impact when users open malicious files. No public exploit identified at time of analysis. Attack requires local access and user interaction (opening a crafted file), with low attack complexity and no authentication requirements (CVSS:3.1 AV:L/AC:L/PR:N/UI:R). EPSS risk data not available; vulnerability enables complete system compromise in user context.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-34622
HIGH
CVSS 8.6
Prototype pollution in Adobe Acrobat Reader allows arbitrary code execution when victims open malicious PDF files. Affects Acrobat Reader versions through 26.001.21411, 24.001.30360, and 24.001.30362. Attack requires local file access with user interaction (CVSS AV:L/UI:R) but achieves scope change and full CIA impact (S:C/C:H/I:H/A:H), yielding CVSS 8.6. No public exploit identified at time of analysis. Vendor advisory available from Adobe (APSB26-44). EPSS data not provided; exploitation status limited to user-interaction-dependent local attack vector.
RCE
Adobe
Prototype Pollution
-
CVE-2026-34619
HIGH
CVSS 7.7
Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier allows authenticated remote attackers to bypass security controls and cause high availability impact through unauthorized file system access. CVSS 7.7 (High) reflects network-accessible attack vector with low complexity requiring only low-privilege authentication and scope change indicating impact beyond vulnerable component. No active exploitation (CISA KEV) or public POC identified at time of analysis, but zero-interaction exploitation pathway and vendor security advisory publication (APSB26-38) indicate concrete threat requiring prompt remediation.
Path Traversal
-
CVE-2026-34618
HIGH
CVSS 7.8
Arbitrary code execution in Adobe Illustrator 30.2, 29.8.5 and earlier versions allows unauthenticated local attackers to execute malicious code with current user privileges via crafted file exploitation. The vulnerability requires user interaction (opening a malicious file) but has low attack complexity once delivered. No public exploit identified at time of analysis, with EPSS data unavailable for risk quantification. The out-of-bounds write flaw affects memory management during file parsing operations.
RCE
Buffer Overflow
Memory Corruption
-
CVE-2026-34617
HIGH
CVSS 8.7
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privilege escalation when low-privileged authenticated users trick victims into visiting malicious URLs. The changed scope (CVSS S:C) indicates the vulnerability can affect resources beyond the vulnerable application's security context. EPSS data not available; no evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis. Requires user interaction (UI:R) but has low attack complexity (AC:L) and network-based attack vector (AV:N), making social engineering campaigns feasible.
XSS
Privilege Escalation
Adobe
-
CVE-2026-34602
HIGH
CVSS 7.1
Insecure Direct Object Reference in Chamilo LMS /api/course_rel_users endpoint allows authenticated attackers to enroll arbitrary users into any course without authorization (CVSS 7.1, High Integrity impact). Affects all versions prior to 2.0.0-RC.3. The vulnerability enables authenticated users to manipulate user-course relationships by modifying the user parameter in API requests, bypassing enrollment controls entirely. No public exploit code identified at time of analysis, though the attack v
Authentication Bypass
-
CVE-2026-34256
HIGH
CVSS 7.1
Authenticated remote attackers can overwrite eight-character executable ABAP reports in SAP ERP and SAP S/4HANA systems due to missing authorization checks, enabling denial-of-service conditions when legitimate users execute corrupted reports. This authorization bypass (CWE-862) requires low-privilege authenticated access (CVSS PR:L) and has low attack complexity, combining limited integrity impact with high availability impact (CVSS 7.1). EPSS data not provided; no public exploit identified at time of analysis. Affects SAP ERP and SAP S/4HANA Private Cloud and On-Premise deployments.
Authentication Bypass
SAP
-
CVE-2026-34160
HIGH
CVSS 8.6
Unauthenticated Server-Side Request Forgery (SSRF) in Chamilo LMS versions prior to 2.0.0-RC.3 allows remote attackers to access internal network services and cloud metadata endpoints via unfiltered package-url parameter in the PENS plugin. Attackers can steal AWS IAM credentials from 169.254.169.254, probe internal infrastructure, and trigger state-changing operations on internal services without requiring authentication. CVSS 8.6 (High) with Changed Scope reflects the ability to pivot from the LMS to other internal systems. No public exploit identified at time of analysis, though the attack vector is straightforward requiring only HTTP requests to the exposed endpoint.
PHP
Authentication Bypass
SSRF
Microsoft
-
CVE-2026-33827
HIGH
CVSS 8.1
Remote code execution in Windows TCP/IP networking stack across Windows 10, 11, and Server versions allows unauthenticated network attackers to execute arbitrary code by exploiting a race condition in shared resource synchronization. The vulnerability affects all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patches addressing this high-severity flaw (CVSS 8.1). No public exploit identified at time of analysis, though SSVC assessment
Authentication Bypass
Race Condition
Microsoft
-
CVE-2026-33826
HIGH
CVSS 8.0
Remote code execution in Windows Active Directory Domain Services affects all supported Windows Server versions (2012 R2 through 2025) when an authenticated attacker with low privileges on an adjacent network sends specially crafted requests to domain controllers. The vulnerability stems from improper input validation (CWE-20) and enables complete system compromise with high impact to confidentiality, integrity, and availability. Patch available per vendor advisory; no public exploit identified at time of analysis. CVSS 8.0 severity reflects adjacent network attack vector requiring low-privilege authentication but trivial attack complexity with no user interaction.
Information Disclosure
Microsoft
-
CVE-2026-33715
HIGH
CVSS 7.2
Server-Side Request Forgery (SSRF) in Chamilo LMS 2.0-RC.2 allows unauthenticated remote attackers to weaponize the learning management system as an open email relay and probe internal networks. The vulnerability stems from an authentication bypass in install.ajax.php, which accepts arbitrary SMTP server connections via Symfony Mailer DSN strings. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L). EPSS data not provided. Vendor-released patch: version 2.0.0-RC.3.
PHP
Authentication Bypass
SSRF
-
CVE-2026-33714
HIGH
CVSS 7.1
SQL injection in Chamilo LMS 2.0.0-RC.2 allows authenticated administrators to extract arbitrary database contents via unsanitized date parameters in the statistics AJAX endpoint's users_active action. This represents an incomplete fix for CVE-2026-30881, where only one of two vulnerable parameter sets was sanitized. Time-based blind SQL injection techniques enable data exfiltration despite requiring admin-level authentication. EPSS data not available; no public exploit identified at time of analysis, though the incomplete remediation pattern and technical details in the GitHub advisory lower exploitation barriers for attackers with admin access.
PHP
SQLi
-
CVE-2026-33120
HIGH
CVSS 8.8
Remote code execution in Microsoft SQL Server 2022 (GDR) allows authenticated network attackers to execute arbitrary code with high confidentiality, integrity, and availability impact via untrusted pointer dereference. The vulnerability affects SQL Server 2022 (GDR) versions below 16.0.1175.1, requires low-privilege authenticated access (PR:L), and has low attack complexity (AC:L), making it straightforward to exploit once network access is obtained. Vendor-released patch available (version 16.0.1175.1). No public exploit identified at time of analysis, though the network attack vector and low complexity suggest moderate near-term exploitation risk.
Information Disclosure
-
CVE-2026-33116
HIGH
CVSS 7.5
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust server resources via specially crafted network requests. The vulnerability (CWE-835) stems from unreachable loop exit conditions in core .NET processing logic, enabling complete service disruption with low attack complexity. Vendor-released patches are available across all affected product lines. No public exploit identified at
Denial Of Service
-
CVE-2026-33115
HIGH
CVSS 8.4
Memory corruption in Microsoft Office Word enables local code execution through a use-after-free flaw affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac. Despite the local attack vector (AV:L), the vulnerability requires no privileges (PR:N) or user interaction (UI:N), allowing unauthorized attackers to execute arbitrary code with high impact to confidentiality, integrity, and availability (CVSS 8.4). Vendor-released patch available via Microsoft Security Response Center as of April 2026. No public exploit identified at time of analysis, though the technical simplicity (AC:L) and memory corruption primitive increase weaponization risk.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-33114
HIGH
CVSS 8.4
Microsoft Office Word untrusted pointer dereference (CWE-822) enables local code execution with high impact across Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 editions (Windows and macOS). The vulnerability requires local access but no privileges or user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), allowing unauthenticated local attackers to achieve full system compromise. Vendor-released patch available per Microsoft Security Response Center advisory. No public exploit identified at time of analysis. SSVC assessment indicates no confirmed exploitation, non-automatable attack, but total technical impact (full control).
Authentication Bypass
Microsoft
-
CVE-2026-33104
HIGH
CVSS 7.0
Local privilege escalation in Windows Win32K graphics subsystem (Win32K-GRFX) allows authenticated attackers with low privileges to gain SYSTEM-level access by exploiting a race condition during concurrent resource access. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Microsoft has released patches addressing this CWE-362 synchronization flaw. No public exploit identified at time of analysis, though the local attack vector and high complexity (
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-33101
HIGH
CVSS 7.8
Local privilege escalation in Windows Print Spooler Components allows authenticated attackers with low privileges to achieve complete system compromise (high confidentiality, integrity, and availability impact) by exploiting a use-after-free memory corruption vulnerability. Affects Windows 11 versions 24H2, 25H2, 26H1, Windows Server 2022 23H2 Edition, and Windows Server 2025. CVSS score 7.8 reflects local attack vector with low complexity and no user interaction required. No public exploit or CISA KEV status identified at time of analysis, though use-after-free vulnerabilities in Print Spooler have historically been attractive exploitation targets.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-33100
HIGH
CVSS 7.0
Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. The CWE-416 use-after-free memory corruption flaw allows low-privileged authenticated attackers with local access to elevate to SYSTEM privileges, achieving complete control over confidentiality, integrity, and availability. SSVC framework rates this as non-automatable with total technical impact. No public exploit
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-33099
HIGH
CVSS 7.0
Local privilege escalation via use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges across all supported Windows versions. Microsoft has released patches for Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-25H2), and Windows Server (2012-2022 23H2). The vulnerability requires local access and low privileges (PR:L) with high attack complexity (AC:H), but no public exploit
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-33098
HIGH
CVSS 7.8
Local privilege escalation in Windows Container Isolation FS Filter Driver affects all supported Windows 10, Windows 11, and Windows Server versions through use-after-free memory corruption. Low-complexity attack requires only low-privileged local access to achieve full system compromise (SYSTEM-level privileges). Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and requirement for only low privileges
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-33096
HIGH
CVSS 7.5
Denial of service in Windows HTTP.sys kernel-mode driver allows unauthenticated remote attackers to crash affected systems via malformed HTTP requests. Affects all currently supported Windows 11 versions (22H2 through 26H1) and Windows Server 2022/2025 editions. The vulnerability stems from an out-of-bounds read (CWE-125) triggered when HTTP.sys processes specially crafted network packets without authentication (CVSS AV:N/PR:N). Vendor-released patches available for all affected versions with specific build numbers identified. No public exploit identified at time of analysis, though low attack complexity (AC:L) suggests straightforward exploitation once technical details emerge.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-33095
HIGH
CVSS 7.8
Use-after-free memory corruption in Microsoft Office Word enables local code execution with high privileges when victims open malicious documents. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac (versions below 16.108.26041219 for Mac; click-to-run editions require latest security updates). CVSS 7.8 reflects local attack vector requiring user interaction, but exploitation grants complete system compromise (confidentiality, integrity, availability all rated High). No public exploit identified at time of analysis, though use-after-free vulnerabilities are well-understood exploitation primitives. Vendor-released patch available through Microsoft security updates.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-33023
HIGH
CVSS 7.8
Use-after-free in libsixel's gdk-pixbuf2 loader enables local attackers to achieve code execution via crafted images. Affects libsixel versions through 1.8.7 when compiled with --with-gdk-pixbuf2 option. The vulnerability stems from inconsistent memory management in load_with_gdkpixbuf(), which manually frees reference-counted frame objects, leaving dangling pointers that callbacks can access post-cleanup. CVSS 7.8 (High) with local attack vector requiring user interaction. Fixed in version 1.8.7-r1. No confirmed active exploitation (CISA KEV), though proof-of-concept feasibility is high given the deterministic nature of the memory corruption.
RCE
Buffer Overflow
Information Disclosure
Use After Free
Memory Corruption
-
CVE-2026-33021
HIGH
CVSS 7.3
Use-after-free in libsixel 1.8.7 and earlier enables local attackers to crash applications or execute arbitrary code via crafted SIXEL image frames. The vulnerability occurs when sixel_encoder_encode_bytes() processes resize operations that free caller-owned pixel buffers, creating dangling pointers exploitable through repeated, predictable frame manipulation. EPSS data not available; no confirmed active exploitation (not in CISA KEV), but the technical details suggest reliable exploitation potential for local privilege escalation or RCE scenarios.
RCE
Use After Free
Memory Corruption
-
CVE-2026-33020
HIGH
CVSS 7.1
Heap buffer overflow in libsixel 1.8.7 and earlier allows local attackers to achieve arbitrary code execution by providing a maliciously crafted large palettised PNG image that triggers integer overflow in RGB888 conversion routines. The vulnerability requires user interaction to process the malicious image but no authentication. EPSS data not available; no public exploit identified at time of analysis, though the technical details in the advisory provide sufficient information for weaponization. Vendor-released patch: version 1.8.7-r1.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-33019
HIGH
CVSS 7.1
Out-of-bounds heap read in libsixel img2sixel via integer overflow allows local attackers to crash the application and potentially leak sensitive memory contents when processing malicious --crop arguments with otherwise valid images. Affects libsixel 1.8.7 and earlier; patched in 1.8.7-r1. EPSS data not available, but exploitation requires local access with user interaction (CVSS AV:L/UI:R). No CISA KEV listing; no public exploit identified at time of analysis.
Buffer Overflow
Information Disclosure
-
CVE-2026-33018
HIGH
CVSS 7.0
Heap use-after-free in libsixel 1.8.7 and earlier allows local code execution when processing malicious animated GIF files through the sixel_helper_load_image_file() API with multi-frame callbacks. The vulnerability triggers when gif_init_frame() unconditionally frees and reallocates frame->pixels between frames while client code retains references via the documented sixel_frame_ref() API, creating dangling pointers confirmed by AddressSanitizer. Fixed in version 1.8.7-r1. No public exploit iden
RCE
Use After Free
Memory Corruption
-
CVE-2026-32225
HIGH
CVSS 8.8
Windows Shell security feature bypass enables unauthenticated remote attackers to defeat protection mechanisms across all supported Windows client and server versions (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025) via network-based attack requiring user interaction. The CVSS 8.8 rating reflects complete compromise potential (high confidentiality, integrity, and availability impact) despite low attack complexity. Microsoft has released patches addressing this authentic
Authentication Bypass
Microsoft
-
CVE-2026-32224
HIGH
CVSS 7.0
Local privilege escalation in Windows Server Update Service (WSUS) on Windows 11 version 26H1 allows low-privileged authenticated users to gain SYSTEM-level access via use-after-free memory corruption. Exploitation requires local access and high attack complexity (CVSS AC:H), indicating timing-dependent or race condition triggers. Microsoft has released patch version 10.0.28000.1836 to address this vulnerability. No public exploit code or active exploitation confirmed at time of analysis.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32222
HIGH
CVSS 7.8
Local privilege escalation in Windows Win32K ICOMP component via untrusted pointer dereference allows low-privileged authenticated users to achieve SYSTEM-level access on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. The vulnerability requires local access and low-privilege credentials (PR:L) but no user interaction, with confirmed patch availability from Microsoft. CVSS 7.8 reflects complete compromise of confidentiality, integrity, and availability. No public exploit identified at tim
Information Disclosure
Microsoft
-
CVE-2026-32221
HIGH
CVSS 8.4
Local privilege escalation in Microsoft Graphics Component across Windows 11 24H2/25H2/26H1 and Server 2025 enables unauthenticated local attackers to execute arbitrary code with high integrity via heap-based buffer overflow exploitation. CVSS 8.4 (High) reflects low attack complexity and no user interaction requirement, though local access is necessary. EPSS data unavailable; no CISA KEV listing or public exploit identified at time of analysis, but the low complexity (AC:L) and no-auth requirement (PR:N) make this highly attractive for post-compromise escalation.
Buffer Overflow
Heap Overflow
Microsoft
-
CVE-2026-32219
HIGH
CVSS 7.0
Double free vulnerability in Microsoft Brokering File System enables local privilege escalation on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. Low-privileged authenticated users can exploit memory corruption (CWE-415) to gain SYSTEM-level access with high attack complexity. Microsoft has released patches addressing builds prior to 10.0.26100.32690 (24H2/Server 2025), 10.0.26200.8246 (25H2), and 10.0.28000.1836 (26H1). EPSS score of 0.04% (11th percentile) and SSVC assessment of no active exploitation suggest low immediate threat despite 7.0 CVSS score, though CISA classifies technical impact as total (complete system compromise).
Information Disclosure
Microsoft
-
CVE-2026-32203
HIGH
CVSS 7.5
Denial of service via stack buffer overflow in .NET (versions 8.0, 9.0, 10.0) and Visual Studio 2022 (versions 17.12, 17.14) allows unauthenticated remote attackers to crash affected applications over the network. The vulnerability has a CVSS score of 7.5 (High) with low attack complexity and no privileges required. Vendor-released patches are available from Microsoft (MSRC). No public exploit identified at time of analysis, and the issue is not confirmed actively exploited.
Buffer Overflow
Stack Overflow
-
CVE-2026-32200
HIGH
CVSS 7.8
Use-after-free memory corruption in Microsoft PowerPoint (versions 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise) enables local code execution when users open malicious files. An attacker with no privileges can achieve full system compromise (high confidentiality, integrity, and availability impact) by convincing a user to open a crafted PowerPoint document. Vendor patch available via Microsoft Security Response Center. No public exploit code or confirmed active exploitation (CISA KEV) identified at time of analysis, though CVSS 7.8 rating reflects high severity for local attack scenarios.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32199
HIGH
CVSS 7.8
Microsoft Excel use-after-free vulnerability (CWE-416) enables arbitrary code execution when a user opens a specially crafted Excel file. Affects Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. CVSS 7.8 (High) requires local access and user interaction but no authentication. No public exploit identified at time of analysis. Microsoft released patches addressing all affected product lines per MSRC update guide.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32198
HIGH
CVSS 7.8
Use-after-free vulnerability in Microsoft Office Excel enables local code execution when users open maliciously crafted Excel files. Affects all major Office versions including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. Attack requires no authentication (PR:N) but demands user interaction (opening a weaponized document). CVSS 7.8 (High) reflects significant impact potential (code execution with high confidentiali
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32197
HIGH
CVSS 7.8
Use-after-free memory corruption in Microsoft Excel across Office 2016-2024 and Microsoft 365 enables local code execution when a user opens a malicious spreadsheet. Attackers must craft a weaponized Excel file and trick users into opening it, after which arbitrary code runs with the victim's privileges. No authentication is required, though user interaction is necessary. Exploitation probability remains moderate (CVSS 7.8) with no confirmed active exploitation (no CISA KEV listing) and no publi
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32195
HIGH
CVSS 7.0
Stack-based buffer overflow in the Windows Kernel enables low-privileged local attackers to escalate to SYSTEM privileges on Windows 11 version 26H1 (build 10.0.28000.0 through 10.0.28000.1835). Despite CVSS 7.0 (High), the attack complexity is high (AC:H) and requires local access with low-level privileges (PR:L). Vendor-released patch available via Microsoft Security Response Center (build 10.0.28000.1836). No public exploit identified at time of analysis, though CWE-121 stack overflows are well-understood vulnerability classes with established exploitation techniques.
Buffer Overflow
Microsoft
Stack Overflow
-
CVE-2026-32192
HIGH
CVSS 7.8
Privilege escalation in Azure Monitor Agent versions prior to 1.41.0 exploits insecure deserialization of untrusted data, allowing authenticated local attackers with low privileges to achieve full system compromise (high confidentiality, integrity, and availability impact). CVSS 7.8 severity reflects local attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the vulnerability class (CWE-502) is well-understood and frequently targeted. Microsoft has released patch version 1.41.0 to address this flaw.
Deserialization
Microsoft
-
CVE-2026-32190
HIGH
CVSS 8.4
Use-after-free memory corruption in Microsoft Office (versions 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise) enables local code execution with no authentication or user interaction required. Attackers with local system access can execute arbitrary code with high impact to confidentiality, integrity, and availability (CVSS 8.4). No public exploit identified at time of analysis. Vendor-released patch available via Microsoft Security Response Center for all affected versions.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32189
HIGH
CVSS 7.8
Microsoft Excel memory corruption via use-after-free enables arbitrary code execution when victims open malicious spreadsheet files. This vulnerability affects all major Office deployments including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, and Office LTSC 2021/2024 for both Windows and macOS, as well as Office Online Server. Attackers require user interaction to open a crafted file, but no authentication is needed (CVSS PR:N), making this exploitable through phishing or file-sharing attacks. Vendor patches are available through Microsoft Security Response Center. No public exploit or active exploitation confirmed at time of analysis, though the straightforward attack vector (local file + user click) and high impact (code execution with full system privileges) warrant prompt patching.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32188
HIGH
CVSS 7.1
Out-of-bounds read vulnerability (CWE-125) in Microsoft Excel allows local attackers to disclose sensitive memory contents and cause denial of service through maliciously crafted spreadsheet files with user interaction. Affects Microsoft Office 2016/2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server across Windows and macOS platforms. CVSS 7.1 reflects high confidentiality and availability impact with low attack complexity but requires local access and user interaction. No public exploit identified at time of analysis. Vendor-released patches available through Microsoft Security Response Center covering all affected Office product lines.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-32184
HIGH
CVSS 7.8
Deserialization of untrusted data in Microsoft HPC Pack 2019 enables authenticated local attackers to escalate privileges to SYSTEM level. Affects all versions below 6.3.8355. Vendor-released patch available via Microsoft Security Response Center. CVSS 7.8 reflects high impact (complete system compromise) with low attack complexity requiring only low-level authenticated access. No public exploit identified at time of analysis, though CWE-502 deserialization flaws are well-understood and commonly weaponized once technical details emerge.
Deserialization
Microsoft
-
CVE-2026-32183
HIGH
CVSS 7.8
Command injection in Windows Snipping Tool allows local code execution when an unauthorized attacker convinces a user to open a specially crafted file. This vulnerability affects all supported Windows 10, Windows 11, and Windows Server versions (2012 through 2025), requiring user interaction but no authentication (PR:N). No public exploit identified at time of analysis, though the local attack vector and user interaction requirement limit immediate remote threat. CVSS 7.8 reflects high impact ac
Command Injection
Microsoft
-
CVE-2026-32178
HIGH
CVSS 7.5
Information disclosure in Microsoft .NET 8.0, 9.0, 10.0, and Visual Studio 2022 allows unauthenticated remote attackers to access sensitive data through improper neutralization of special elements. This spoofing vulnerability (CWE-138) enables attackers to bypass authentication mechanisms and extract high-confidentiality information over the network with low attack complexity. No active exploitation confirmed (not in CISA KEV), but the network-accessible, no-authentication-required attack profile presents immediate risk for internet-facing .NET applications. Vendor patches available for all affected versions.
Authentication Bypass
-
CVE-2026-32171
HIGH
CVSS 8.8
Azure Logic Apps fails to adequately protect stored credentials, enabling authenticated attackers with network access to escalate privileges and gain unauthorized access to sensitive data. With a CVSS score of 8.8 and low attack complexity (AC:L), this vulnerability poses significant risk to cloud environments where Logic Apps handle integration credentials. Microsoft has released a patch addressing the credential protection weakness. No public exploit identified at time of analysis, though the low complexity suggests straightforward exploitation once authentication is obtained.
Information Disclosure
Microsoft
-
CVE-2026-32168
HIGH
CVSS 7.8
Local privilege escalation in Azure Monitor Agent versions prior to 1.35.9 enables authenticated users to gain elevated system privileges through improper input validation flaws. The vulnerability requires low attack complexity and no user interaction, allowing low-privileged attackers with local access to achieve complete system compromise (high confidentiality, integrity, and availability impact). EPSS data not available; no public exploit identified at time of analysis; SSVC framework indicates total technical impact but no active exploitation and non-automatable exploitation vector.
Information Disclosure
Microsoft
-
CVE-2026-32165
HIGH
CVSS 7.8
Local privilege escalation in Windows User Interface Core across Windows 10, 11, and Server 2019-2025 allows low-privileged authenticated attackers to achieve SYSTEM-level access via use-after-free memory corruption. The vulnerability requires high attack complexity and local access but enables container escape (scope change) with full confidentiality, integrity, and availability impact. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the use-after-free primitive is a well-understood exploitation technique.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32164
HIGH
CVSS 7.8
Local privilege escalation in Windows User Interface Core across Windows 10, 11, and Server 2016-2025 allows low-privileged authenticated users to gain elevated system access via a race condition vulnerability. Attack complexity is high (AC:H), requiring precise timing exploitation of shared resource synchronization flaws. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the local attack vector and authenticated requirement
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32163
HIGH
CVSS 7.8
Privilege escalation in Windows User Interface Core across Windows 10 (1809-22H2), Windows 11 (22H3-26H1), and Windows Server (2019-2025) allows authenticated local attackers to gain elevated privileges via race condition exploitation. Vendor-released patches available for all affected versions. No public exploit identified at time of analysis. CVSS 7.8 (high) with local attack vector and high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C) indicates significant real-world risk in multi-user environments where low-privilege users can access affected systems.
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32162
HIGH
CVSS 8.4
Local privilege escalation in Windows COM across Windows 10 (1809, 21H2, 22H2), Windows 11 (22H3-26H1), and Windows Server (2019-2025) allows unauthenticated attackers with local access to achieve full system compromise (high confidentiality, integrity, and availability impact) by exploiting acceptance of untrusted data alongside trusted data. CVSS 8.4 reflects the severe impact of complete privilege escalation despite requiring local access. Vendor-released patch available with specific build n
Authentication Bypass
Microsoft
-
CVE-2026-32160
HIGH
CVSS 7.8
Local privilege escalation in Windows Push Notifications service affects Windows 10 (1809-22H2), Windows 11 (22H3-26H1), and Windows Server 2019-2025 via race condition in shared resource synchronization. Low-privileged authenticated users can exploit timing vulnerabilities in notification handling to elevate to SYSTEM-level privileges with high confidentiality, integrity, and availability impact (scope change to other security contexts). CVSS 7.8 (high complexity, local vector). Vendor-released
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32159
HIGH
CVSS 7.8
Privilege escalation in Windows Push Notifications service affects all supported Windows 10, 11, and Server versions through a race condition that allows low-privileged authenticated users to gain SYSTEM-level access. The vulnerability (CWE-362) stems from improper synchronization when multiple threads access shared resources in the notification subsystem. Attack complexity is high (AC:H), requiring precise timing to win the race, but successful exploitation grants complete system compromise wit
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32158
HIGH
CVSS 7.8
Privilege escalation in Windows Push Notifications service across Windows 10, 11, and Server versions (1809 through 26H1) allows low-privileged local attackers to gain SYSTEM-level access via race condition exploitation. The vulnerability stems from improper synchronization when multiple threads access shared resources in the notification framework, enabling scope escape from user context to elevated privileges. Vendor-released patches are available for all affected versions. No public exploit i
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32157
HIGH
CVSS 8.8
Remote code execution in Microsoft Remote Desktop Client for Windows allows unauthenticated network attackers to execute arbitrary code by delivering a malicious connection file or server response, requiring user interaction. This use-after-free vulnerability (CWE-416) affects Windows 10 (versions 1607-22H2), Windows 11 (22H3-26H1), Windows Server (2012-2025), and standalone Remote Desktop client versions below 2.0.1070.0. With CVSS 8.8 (network-accessible, no authentication required, low comple
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-32156
HIGH
CVSS 7.4
Local code execution in Windows Universal Plug and Play (UPnP) Device Host across all supported Windows 10, 11, and Server versions allows unauthenticated attackers to achieve high-impact compromise via use-after-free memory corruption. The vulnerability affects Windows 10 versions 1607 through 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2012 through 2025 (including Server Core installations). Despite requiring local access and high attack complexity (CVSS:3.1/AV:L/AC:H), the
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32155
HIGH
CVSS 7.8
Desktop Window Manager (DWM) privilege escalation via use-after-free memory corruption affects Windows 10 21H2/22H2, Windows 11 22H3 through 25H2, and Windows Server 2022/2025. Local authenticated attackers with low privileges can exploit this memory corruption flaw to gain SYSTEM-level access, achieving full compromise of confidentiality, integrity, and availability. Vendor-released patches are available across all affected platforms. No public exploit identified at time of analysis, though the
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-32154
HIGH
CVSS 7.8
Local privilege escalation in Microsoft Desktop Window Manager (dwm.exe) affects all supported Windows 10, Windows 11, and Windows Server versions via a use-after-free memory corruption flaw. Authenticated local attackers with low privileges can exploit this CWE-416 weakness to gain SYSTEM-level access with low attack complexity, requiring no user interaction. No public exploit identified at time of analysis, and SSVC framework assesses exploitation status as 'none' with non-automatable attack r
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-32153
HIGH
CVSS 7.8
Use-after-free in Microsoft Windows Speech component enables local privilege escalation to SYSTEM on Windows 10 (versions 1809, 21H2, 22H2) and Windows 11 (versions 22H3 through 26H1). Authenticated local attackers with low privileges can exploit memory corruption to gain full system control with low attack complexity and no user interaction required. CVSS 7.8 (High). Vendor-released patches available for all affected versions. No public exploit identified at time of analysis, though the straigh
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32152
HIGH
CVSS 7.8
Desktop Window Manager (DWM) use-after-free vulnerability enables local privilege escalation to SYSTEM on Windows 11 and Server 2022/2025. Low-complexity attack requires only low-privileged authenticated access with no user interaction, affecting all current Windows 11 versions (22H2 through 26H1) and Server editions. Vendor-released patches available as of May 2026. CVSS 7.8 (High) reflects significant local privilege escalation risk; no public exploit identified at time of analysis, though the
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-32150
HIGH
CVSS 7.0
Local privilege escalation in Microsoft Windows Function Discovery Service (fdwsd.dll) allows low-privileged authenticated users to gain SYSTEM-level access via a race condition. Affects all supported Windows 10, 11, and Server versions from 2012 through 2025. Vendor-released patches available from Microsoft. CVSS 7.0 (high complexity local attack). No public exploit identified at time of analysis, though the race condition class (CWE-362) is well-understood and commonly weaponized once details emerge.
Information Disclosure
Race Condition
-
CVE-2026-32149
HIGH
CVSS 7.3
Windows Hyper-V local privilege escalation via improper input validation (CWE-20) enables authenticated low-privilege attackers with user interaction to execute arbitrary code with high confidentiality, integrity, and availability impact across Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server (2016-2025). Microsoft released patches addressing the vulnerability with EPSS exploitation probability data not available; no public exploit identified at time of analys
Information Disclosure
Microsoft
-
CVE-2026-32093
HIGH
CVSS 7.0
Local privilege escalation in Microsoft Windows Function Discovery Service (fdwsd.dll) allows authenticated low-privilege attackers to gain SYSTEM-level access via race condition exploitation across all supported Windows 10, Windows 11, and Windows Server versions (2012-2025). The vulnerability requires local access and low privileges (CVSS PR:L) with high attack complexity (AC:H), yielding complete system compromise (C:H/I:H/A:H). Microsoft released patches addressing build versions up to 10.0.26100.32690 (Server 2025) and 10.0.28000.1836 (Windows 11 26H1). EPSS data not available; no public exploit identified at time of analysis.
Information Disclosure
Race Condition
-
CVE-2026-32091
HIGH
CVSS 8.4
Local privilege escalation in Microsoft Windows Brokering File System allows unprivileged attackers with physical or local access to gain SYSTEM-level privileges through a race condition vulnerability. The flaw affects all supported Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. Despite an 8.4 CVSS score indicating high severity, real-world risk is moderate: EPSS score of 0.04% (12th percentile) suggests low exploitation likelihood, SSVC framework confirms no active exploitation, and the local attack vector limits exposure to scenarios where attackers already have local access. Vendor-released patches are available for all affected versions.
Authentication Bypass
Race Condition
Microsoft
-
CVE-2026-32090
HIGH
CVSS 7.8
Local privilege escalation in Windows Speech Brokered API allows authenticated users with low privileges to gain SYSTEM-level access via race condition exploitation. Affects all supported Windows 10, Windows 11, and Windows Server versions (2016-2025). Microsoft released patches in May 2025 across 17 product variants. Despite CVSS 7.8 severity, EPSS score is low (0.04%, 12th percentile) indicating minimal observed exploitation activity. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis.
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32089
HIGH
CVSS 7.8
Local privilege escalation in Windows Speech Brokered API allows authenticated users to gain SYSTEM-level access via use-after-free memory corruption. All supported Windows 10, Windows 11, and Windows Server versions (2016-2025) are affected. Microsoft released patches in their April 2026 security update cycle. EPSS score of 0.04% (12th percentile) indicates low exploitation likelihood in the wild, and no active exploitation or public exploit code has been identified at time of analysis.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32087
HIGH
CVSS 7.0
Heap-based buffer overflow in Microsoft Windows Function Discovery Service (fdwsd.dll) enables low-privileged authenticated local attackers to escalate privileges to SYSTEM across Windows 10, Windows 11, and Windows Server 2012-2025. Vendor-released patch available per Microsoft Security Response Center advisory. No public exploit identified at time of analysis, though the CVSS vector indicates local access with high attack complexity (AC:H), requiring authenticated low-privilege users (PR:L). A
Buffer Overflow
Heap Overflow
-
CVE-2026-32086
HIGH
CVSS 7.0
Privilege escalation in Windows Function Discovery Service (fdwsd.dll) allows authenticated local attackers to gain SYSTEM-level access by exploiting a race condition during shared resource handling. Affects all supported Windows 10/11 client versions and Windows Server 2012 through 2025. Vendor-released patches are available per Microsoft's May 2026 Patch Tuesday. No public exploit identified at time of analysis, but CVSS 7.0 reflects high complexity local attack requiring low privileges.
Information Disclosure
Race Condition
-
CVE-2026-32083
HIGH
CVSS 7.0
Local privilege escalation in Windows SSDP Service (all Windows 10, 11, and Server versions from 2012 onwards) enables low-privileged authenticated users to gain SYSTEM-level access by exploiting a race condition in shared resource handling. The vulnerability requires low privileges and high attack complexity (CVSS AC:H), resulting in complete compromise of confidentiality, integrity, and availability. Vendor-released patches are available for all affected versions with specific build numbers pr
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32082
HIGH
CVSS 7.0
Local privilege escalation in Windows SSDP Service across Windows 10, Windows 11, and Windows Server 2012-2025 allows authenticated users with low privileges to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Attack complexity is high (AC:H), requiring precise timing to win the race window. Patch available per vendor advisory; no public exploit identified at time of analysis.
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-32080
HIGH
CVSS 7.0
Local privilege escalation in Microsoft Windows WalletService across Server 2016 through Server 2025 allows low-privileged authenticated attackers to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw. Attack complexity is high (CVSS AC:H), requiring precise timing or race condition exploitation. Patch available per vendor advisory (MSRC). No public exploit identified at time of analysis, EPSS data not provided.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32078
HIGH
CVSS 7.8
Local privilege escalation in Windows Projected File System (ProjFS) across Windows 10, Windows 11, and Windows Server 2019-2025 allows authenticated low-privileged users to gain SYSTEM-level control via use-after-free memory corruption. Attack requires local access and low-privileged credentials (CVSS PR:L) but no user interaction, enabling complete compromise of confidentiality, integrity, and availability. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the vulnerability class (use-after-free) is well-understood and commonly targeted once details emerge.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32077
HIGH
CVSS 7.8
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host enables authenticated local attackers to elevate privileges to SYSTEM level across all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. The vulnerability (CWE-822) requires low-privilege authenticated access and minimal attack complexity (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis. Microsoft released patches for all affected versions including
Information Disclosure
Microsoft
-
CVE-2026-32076
HIGH
CVSS 7.8
Local privilege escalation in Windows Storage Spaces Controller (Windows 11 22H2-26H1, Server 2022-2025) enables low-privileged authenticated users to gain SYSTEM-level access via out-of-bounds read exploitation. CVSS 7.8 (High). No public exploit identified at time of analysis, but ENISA EUVD tracking indicates European regulatory attention. Vendor-released patches available for all affected versions.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-32075
HIGH
CVSS 7.0
Local privilege escalation in Windows Universal Plug and Play (UPnP) Device Host allows authenticated attackers with low privileges to achieve system-level access through use-after-free memory corruption. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Microsoft has released patches across all affected product lines. No public exploit identified at time of analysis, though the local attack vector and authentication requirement (PR:L) limit immedi
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32074
HIGH
CVSS 7.8
Local privilege escalation via double free vulnerability in Windows Projected File System (ProjFS) enables low-privileged authenticated users to achieve SYSTEM-level access across Windows 10, Windows 11, and Windows Server environments. The CWE-415 memory corruption flaw requires low attack complexity and no user interaction, affecting all actively supported Windows versions from legacy 1809 builds through current 26H1 releases. Vendor-released patches are available with build numbers confirmed
Information Disclosure
Microsoft
-
CVE-2026-32073
HIGH
CVSS 7.0
Local privilege escalation via use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys) affects all supported Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012-2025. Authenticated local attackers with low privileges can exploit memory corruption to gain SYSTEM-level access, though high attack complexity suggests reliable exploitation requires sophisticated techniques. Vendor-released patches are available across all affected versions. No publi
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32071
HIGH
CVSS 7.5
Remote denial-of-service in Windows Local Security Authority Subsystem Service (LSASS) allows unauthenticated network attackers to crash Windows systems through null pointer dereference exploitation. Affects Windows 10 (versions 1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025) across multiple release channels. Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and unauthenticated netwo
Denial Of Service
Null Pointer Dereference
Microsoft
-
CVE-2026-32070
HIGH
CVSS 7.0
Local privilege escalation in Windows Common Log File System (CLFS) Driver affects Windows 10, 11, and Server 2012-2025 through a use-after-free memory corruption flaw. Authenticated local attackers with low privileges can exploit this vulnerability to gain SYSTEM-level access, achieving full control over confidentiality, integrity, and availability. While no public exploit identified at time of analysis, the Windows CLFS driver has been a frequent target for privilege escalation exploits histor
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-32069
HIGH
CVSS 7.8
Privilege escalation in Windows Projected File System (ProjFS) enables low-privileged local users to gain SYSTEM-level control through a double-free memory corruption vulnerability across Windows 10, 11, and Server 2019-2025. Vendor-released patch available for all affected versions (build numbers 10.0.17763.8644+, 10.0.19044.7184+, 10.0.22631.6936+, 10.0.26100.32690+, and newer). No public exploit identified at time of analysis, though the local attack vector with low complexity (CVSS AV:L/AC:L
Information Disclosure
Microsoft
-
CVE-2026-32068
HIGH
CVSS 7.0
Local privilege escalation in Windows SSDP Service affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 via a race condition vulnerability. Authenticated local users with low privileges can exploit improper synchronization in shared resource access to gain SYSTEM-level privileges, achieving full system compromise. Vendor-released patches are available across all affected versions. No public exploit identified at time of analysis, though the local attack vector and high impact warrant priority patching on multi-user or sensitive systems.
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-31923
HIGH
CVSS 7.5
Sensitive authentication tokens in Apache APISIX OpenID Connect plugin transmit in cleartext when connecting to identity providers, affecting versions 0.7 through 3.15.0. The ssl_verify parameter defaults to false, disabling TLS certificate validation and enabling potential man-in-the-middle interception of authentication credentials. With CVSS 7.5 (High), network-based attackers can intercept confidential data without authentication. EPSS probability is minimal (0.01%, 2nd percentile) with no confirmed active exploitation (CISA KEV absent), indicating theoretical risk despite high CVSS severity.
Apache
Information Disclosure
-
CVE-2026-27929
HIGH
CVSS 7.0
Windows LUAFV driver privilege escalation via TOCTOU race condition allows authenticated local attackers with low privileges to gain SYSTEM-level access across all supported Windows 10, Windows 11, and Windows Server versions (2012 through 2025). The vulnerability requires high attack complexity to exploit the narrow timing window between security checks and file operations. Vendor-released patch available across all affected platforms. No public exploit identified at time of analysis, though th
Information Disclosure
Microsoft
-
CVE-2026-27928
HIGH
CVSS 8.7
Windows Hello authentication bypass on Server 2016-2025 allows unauthenticated remote attackers to circumvent biometric/PIN security mechanisms over a network despite high attack complexity. CVSS 8.7 (Critical) with scope change indicates potential lateral movement from compromised Hello authentication into broader Windows security context. Vendor-released patches available for all affected versions (builds 10.0.14393.9060, 10.0.17763.8644, 10.0.20348.5020, 10.0.25398.2274, 10.0.26100.32690). No confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though VulDB tracking suggests security community awareness.
Authentication Bypass
Microsoft
-
CVE-2026-27927
HIGH
CVSS 7.8
Privilege escalation in Windows Projected File System across Windows 10, 11, and Server versions allows authenticated local users to gain SYSTEM-level privileges by exploiting a race condition during concurrent file system operations. Affects all currently supported Windows versions from Server 2019 through Windows 11 26H1. Microsoft released patches in their latest security update cycle. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and minimal privil
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-27926
HIGH
CVSS 7.0
Local privilege escalation in Windows Cloud Files Mini Filter Driver (all Windows 10/11 and Server 2019/2022/2025 versions) allows low-privileged authenticated users to gain SYSTEM-level access through a race condition vulnerability. Attack requires high complexity timing manipulation of shared resources in the kernel-mode filter driver. Vendor-released patches available for all affected versions. No public exploit identified at time of analysis, though the authenticated local attack vector and detailed version-specific fix data suggest moderate real-world deployment risk in multi-user Windows environments.
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-27924
HIGH
CVSS 7.8
Desktop Window Manager (DWM) in Windows 10 21H2/22H2, Windows 11 22H3/23H2, and Windows Server 2022 allows authenticated local attackers with low privileges to elevate to SYSTEM via a use-after-free memory corruption flaw. CVSS 7.8 (High). Vendor-released patch available. No public exploit identified at time of analysis, though EPSS data not provided. This is a post-authentication escalation requiring initial local foothold, not a remote intrusion vector.
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-27923
HIGH
CVSS 7.8
Desktop Window Manager (DWM) use-after-free memory corruption allows authenticated local attackers to escalate privileges to SYSTEM on all supported Windows 10, Windows 11, and Windows Server versions (2012-2025). The vulnerability enables low-privileged users to gain complete control over affected systems with low attack complexity and no user interaction required. Vendor-released patches are available across all affected versions. No public exploit identified at time of analysis, though the st
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-27922
HIGH
CVSS 7.0
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) affects all Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 via a use-after-free memory corruption flaw. Authenticated local attackers with low privileges can exploit this CWE-416 vulnerability to achieve full system compromise (SYSTEM-level access), though the high attack complexity (AC:H) suggests exploitation requires precise timing or race condition manipulation. No public exp
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27921
HIGH
CVSS 7.0
Local privilege escalation in Windows TCP/IP stack across Windows 10, 11, and Server editions allows low-privileged authenticated users to gain SYSTEM-level access by exploiting a race condition in shared resource synchronization. This CWE-362 flaw affects every supported Windows version from legacy Server 2012 through cutting-edge Windows 11 26H1, with vendor-released patches available. The local attack vector (AV:L) and high complexity (AC:H) reduce immediate mass-exploitation risk, though the
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-27920
HIGH
CVSS 7.8
Local privilege escalation in Windows Universal Plug and Play Device Host service affects all supported Windows 10, Windows 11, and Windows Server versions via untrusted pointer dereference (CWE-822). Low-complexity attack requires low-level authenticated access (PR:L) with no user interaction, enabling complete system compromise (C:H/I:H/A:H). Microsoft released patches in May 2025 for 21 affected product versions. No public exploit identified at time of analysis, though the local attack vector
Information Disclosure
Microsoft
-
CVE-2026-27919
HIGH
CVSS 7.8
Local privilege escalation in Windows Universal Plug and Play (UPnP) Device Host affects all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Authenticated local attackers with low privileges can exploit an untrusted pointer dereference (CWE-822) to achieve complete system compromise with high impact to confidentiality, integrity, and availability. Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, thoug
Information Disclosure
Microsoft
-
CVE-2026-27918
HIGH
CVSS 7.8
Windows Shell privilege escalation affects Windows 10 (1809+), Windows 11 (all versions through 26H1), and Windows Server 2019-2025 via a race condition vulnerability (CWE-362). Local authenticated attackers with low-privilege access can exploit concurrent execution flaws to gain SYSTEM-level privileges with low attack complexity and no user interaction required (CVSS 7.8). Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though t
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-27917
HIGH
CVSS 7.0
Local privilege escalation in Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) across Windows 10, 11, and Server 2012 R2-2025 allows authenticated attackers with low privileges to gain SYSTEM-level access via use-after-free memory corruption. Microsoft released patches addressing versions from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. CVSS 7.0 rating reflects high attack complexity; no public exploit identified at time of analysis. EPSS data not prov
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27916
HIGH
CVSS 7.8
Windows Universal Plug and Play (UPnP) Device Host privilege escalation allows authenticated local attackers to gain SYSTEM-level access via use-after-free memory corruption. Affects all supported Windows versions from Server 2012 through Windows 11 26H1 and Windows Server 2025. Vendor-released patches available. Attack requires low complexity with no user interaction (CVSS:3.1 AV:L/AC:L/PR:L/UI:N). No public exploit identified at time of analysis, though the primitive nature of use-after-free v
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27915
HIGH
CVSS 7.8
Local privilege escalation via use-after-free memory corruption in Windows Universal Plug and Play (UPnP) Device Host affects all supported Windows versions from Server 2012 through Windows 11 26H1. Authenticated local attackers with low privileges can exploit this CWE-416 flaw to gain SYSTEM-level access with low attack complexity (CVSS:3.1 AV:L/AC:L/PR:L). Vendor-released patches are available across all affected Windows 10, Windows 11, and Windows Server product lines. No public exploit code
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27914
HIGH
CVSS 7.8
Microsoft Management Console privilege escalation affects all supported Windows versions (10, 11, Server 2012-2025) via improper access control, allowing authenticated local users to gain SYSTEM-level privileges. CVSS 7.8 (High) reflects significant impact with low attack complexity requiring only low-level user credentials. Vendor-released patches available across all affected platforms through Microsoft's May 2025 update cycle. No public exploit identified at time of analysis, though the authe
Authentication Bypass
Microsoft
-
CVE-2026-27913
HIGH
CVSS 7.7
BitLocker encryption bypass in Windows Server 2012 through 2022 enables local attackers with physical access to circumvent disk encryption protections without authentication. The vulnerability affects all Server Core and standard editions across ten years of Windows Server releases. Patch available per Microsoft Security Response Center (MSRC-2026-27913). No public exploit identified at time of analysis, but the local attack vector (AV:L) with no authentication requirement (PR:N) indicates high risk in scenarios where physical device access is possible, such as lost/stolen servers or insider threats.
Authentication Bypass
Microsoft
-
CVE-2026-27912
HIGH
CVSS 8.0
Windows Kerberos authorization bypass enables authenticated attackers on adjacent networks to escalate privileges to high integrity levels across Windows Server 2012 through 2025. The flaw affects both desktop experience and Server Core installations. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and lack of user interaction (UI:N) suggest straightforward exploitation once adjacent network access is achieved.
Authentication Bypass
Microsoft
-
CVE-2026-27911
HIGH
CVSS 7.8
Race condition in Windows User Interface Core (MSRC patch CVE-2026-27911) enables low-privileged authenticated attackers to elevate privileges to SYSTEM level on Windows 10, Windows 11, and Windows Server 2016-2025 systems. The flaw stems from improper synchronization when multiple threads concurrently access shared resources in the UI subsystem, creating a time-of-check-time-of-use (TOCTOU) window exploitable for privilege escalation. Patch available per vendor advisory. No public exploit ident
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-27910
HIGH
CVSS 7.8
Windows Installer privilege escalation via improper permission handling enables authenticated local users to gain SYSTEM-level access across all supported Windows 10, 11, and Server platforms (2012-2025). The vulnerability (CWE-280: Improper Handling of Insufficient Privileges) requires low-privilege local access but offers complete system compromise with low attack complexity. CVSS 7.8 High severity reflects full confidentiality, integrity, and availability impact. Vendor-released patches are a
Information Disclosure
Microsoft
-
CVE-2026-27909
HIGH
CVSS 7.8
Local privilege escalation in Microsoft Windows Search Component affects Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2012-2025) via use-after-free memory corruption (CWE-416). Authenticated local attackers with low privileges can exploit this vulnerability to gain SYSTEM-level access with low attack complexity and no user interaction required (CVSS 7.8). Vendor-released patches available for all affected versions; no public exploit identified at time of analysis.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27908
HIGH
CVSS 7.0
Use-after-free in Windows TDI Translation Driver (tdx.sys) allows local privilege escalation to SYSTEM by authenticated low-privileged users on Windows 10/11 and Server 2012-2025. Microsoft has released security updates addressing this CWE-416 memory corruption flaw across all supported Windows versions. CVSS 7.0 reflects high attack complexity but full system compromise if successfully exploited. No public exploit identified at time of analysis, though the vulnerability's local attack vector an
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27907
HIGH
CVSS 7.8
Local privilege escalation in Windows Storage Spaces Controller across Windows 11 (versions 22H3 through 26H1) and Windows Server 2022/2025 allows low-privileged authenticated users to achieve SYSTEM-level access via an integer underflow vulnerability. The flaw enables complete compromise of confidentiality, integrity, and availability on affected systems. EPSS risk data not available; no public exploit identified at time of analysis. Vendor-released patches are available for all affected versions.
Information Disclosure
Integer Overflow
Microsoft
-
CVE-2026-27668
HIGH
CVSS 8.7
Privilege escalation in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8 allows authenticated User Administrators to escalate their own privileges through improper group administration controls. Authenticated attackers with low-privilege User Administrator credentials can exploit flawed group membership logic to grant themselves unrestricted access to any device group at any access level, achieving full administrative control over critical industrial infrastructure. CVSS 8.8 (High) reflects network-accessible attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated insiders.
Privilege Escalation
-
CVE-2026-27313
HIGH
CVSS 7.8
Arbitrary code execution in Adobe Bridge 16.0.2, 15.1.4 and earlier allows local attackers to execute malicious code with current user privileges through specially crafted files. CVSS 7.8 (High) with EPSS data not available. No public exploit identified at time of analysis. Exploitation requires victim to open a malicious Bridge file, making this a realistic threat for targeted attacks using phishing or social engineering delivery methods.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-27312
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe Bridge 16.0.2, 15.1.4, and earlier allows arbitrary code execution with user privileges when processing malicious files. CVSS 7.8 (High) reflects the local attack vector requiring victim interaction to open a crafted file. No public exploit identified at time of analysis, with SSVC framework rating this as non-automatable but capable of total technical impact. Exploitation requires social engineering to deliver the malicious file to the target user.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-27311
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe Bridge 16.0.2, 15.1.4, and earlier versions enables arbitrary code execution with user privileges when processing maliciously crafted files. CVSS 7.8 reflects high impact across confidentiality, integrity, and availability, requiring local access and user interaction. CISA SSVC framework categorizes this as non-automatable with total technical impact. No public exploit identified at time of analysis, and vendor has released security advisory APSB26-39 addressing the vulnerability.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-27310
HIGH
CVSS 7.8
Arbitrary code execution via heap-based buffer overflow in Adobe Bridge (versions 16.0.2, 15.1.4 and earlier) allows local attackers to execute code in the user's security context by tricking victims into opening specially crafted malicious files. No public exploit identified at time of analysis, with SSVC assessment indicating no current exploitation, non-automatable attack requiring user interaction, and total technical impact upon successful compromise.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-27306
HIGH
CVSS 8.4
Arbitrary code execution in Adobe ColdFusion 2023.18, 2025.6 and earlier allows authenticated attackers with high privileges to execute malicious code through improper input validation. Exploitation requires user interaction (victim opening a malicious file). EPSS data not available; no confirmed active exploitation (not in CISA KEV). CVSS 8.4 reflects high impact across confidentiality, integrity, and availability with scope change, though real-world risk is constrained by requiring both elevated privileges and user interaction.
RCE
-
CVE-2026-27305
HIGH
CVSS 8.6
Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier enables unauthenticated remote attackers to read arbitrary files from the server file system without user interaction. The vulnerability carries a CVSS score of 8.6 (High) due to network accessibility, low complexity, and scope change, allowing access to sensitive files and directories beyond intended boundaries. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the lack of authentication requirements and low attack complexity suggest elevated risk for publicly accessible ColdFusion instances.
Path Traversal
-
CVE-2026-27298
HIGH
CVSS 7.8
Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute code with current user privileges via maliciously crafted files. The type confusion vulnerability (CWE-843) requires user interaction to open a weaponized document. CVSS 7.8 (High) reflects significant impact (full confidentiality, integrity, availability compromise) once exploitation succeeds. No public exploit identified at time of analysis, though the local attack vector and user interaction requirement reduce immediate remote exploitation risk.
RCE
Memory Corruption
Adobe
-
CVE-2026-27297
HIGH
CVSS 7.8
Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute code in user context by delivering malicious FrameMaker documents that trigger integer underflow during file parsing. Attack requires social engineering to convince targets to open crafted files. No public exploit identified at time of analysis, though CVSS 7.8 severity reflects high impact across confidentiality, integrity, and availability if successfully exploited.
RCE
Integer Overflow
Adobe
-
CVE-2026-27296
HIGH
CVSS 7.8
Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute malicious code with current user privileges through specially crafted files exploiting an integer underflow. Attack requires user interaction (opening a malicious file). CVSS 7.8 (High) reflects local attack vector with low complexity. No public exploit identified at time of analysis, and EPSS data not provided. Vendor advisory available at Adobe PSIRT (APSB26-36).
RCE
Integer Overflow
Adobe
-
CVE-2026-27295
HIGH
CVSS 7.8
Out-of-bounds write in Adobe FrameMaker 2022.8 and earlier enables arbitrary code execution when users open specially crafted malicious files. The vulnerability achieves full confidentiality, integrity, and availability impact (CVSS 7.8 HIGH) but requires local access and user interaction, limiting immediate risk. No public exploit identified at time of analysis, and exploitation requires social engineering to deliver the malicious file to victims.
RCE
Buffer Overflow
Memory Corruption
Adobe
-
CVE-2026-27294
HIGH
CVSS 7.8
Out-of-bounds read in Adobe FrameMaker 2022.8 and earlier enables arbitrary code execution when users open malicious crafted files. Exploitation requires local access and user interaction (CVSS 7.8, AV:L/UI:R), allowing attackers to execute code with current user privileges and achieve high confidentiality, integrity, and availability impact. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Adobe has released security bulletin APSB26-36 addressing this vulnerability.
Buffer Overflow
Information Disclosure
Adobe
-
CVE-2026-27293
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe FrameMaker 2022.8 and earlier enables arbitrary code execution with high integrity and confidentiality impact when users open specially crafted malicious files. Attack requires local access and user interaction (CVSS 7.8, AV:L/UI:R), limiting remote exploitation scenarios. No public exploit identified at time of analysis. EPSS data not available, and vulnerability not listed in CISA KEV, suggesting exploitation remains theoretical despite the high CVSS score.
RCE
Buffer Overflow
Heap Overflow
Adobe
-
CVE-2026-27292
HIGH
CVSS 7.8
Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute malicious code with current user privileges by tricking victims into opening specially crafted files. This use-after-free memory corruption vulnerability requires no authentication but depends on user interaction. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis, though the local attack vector and user interaction requirement reduce immediate remote threat surface compared to network-accessible vulnerabilities.
RCE
Denial Of Service
Use After Free
Memory Corruption
Adobe
-
CVE-2026-27291
HIGH
CVSS 7.8
Arbitrary code execution in Adobe InDesign Desktop versions through 21.2 allows unauthenticated attackers to execute malicious code with full user privileges by exploiting an out-of-bounds write vulnerability via a specially crafted InDesign file. Attack requires local access and user interaction to open the malicious document. No public exploit identified at time of analysis, though CVSS 7.8 reflects high impact if successfully exploited. Adobe has released security bulletin APSB26-32 addressing this memory corruption flaw.
RCE
Buffer Overflow
Memory Corruption
-
CVE-2026-27290
HIGH
CVSS 8.6
Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier via DLL hijacking/search path manipulation allows local attackers to run malicious code in user context without interaction. CVSS 8.6 severity stems from changed scope and high confidentiality/integrity/availability impact despite local attack vector. No public exploit identified at time of analysis. EPSS data not available for this recent CVE. Vendor patch released per Adobe Security Bulletin APSB26-36.
RCE
Adobe
-
CVE-2026-27289
HIGH
CVSS 7.8
Out-of-bounds read in Adobe Photoshop Desktop 27.4 and earlier enables arbitrary code execution when users open malicious files. Attackers can read beyond allocated memory boundaries during file parsing to execute code with current user privileges. CVSS 7.8 (High) reflects local attack vector requiring user interaction. No public exploit identified at time of analysis, though exploitation requires only low complexity once a victim opens the crafted file.
Buffer Overflow
Information Disclosure
-
CVE-2026-27287
HIGH
CVSS 7.8
Out-of-bounds read in Adobe InCopy 20.5.2, 21.2 and earlier allows arbitrary code execution when users open malicious files. CVSS 7.8 (High) reflects local attack vector requiring user interaction to open a weaponized document, which then triggers memory disclosure leading to code execution in user context. No public exploit identified at time of analysis. EPSS data not available, but the local-only attack vector and mandatory user interaction substantially reduce real-world risk compared to remotely exploitable flaws.
Buffer Overflow
Information Disclosure
-
CVE-2026-27284
HIGH
CVSS 7.8
Out-of-bounds read in Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier enables arbitrary code execution when users open malicious files. Attack requires local access and user interaction (CVSS AV:L/UI:R) but no authentication (PR:N), allowing attackers with file delivery capability to execute code as the victim user. No public exploit identified at time of analysis, though the vulnerability class (CWE-125 out-of-bounds read) is well-understood and commonly weaponized in document processors.
Buffer Overflow
Information Disclosure
-
CVE-2026-27283
HIGH
CVSS 7.8
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to execute malicious code with current user privileges through maliciously crafted files. The use-after-free vulnerability requires user interaction (opening a weaponized InDesign file) but offers high impact across confidentiality, integrity, and availability. EPSS data not provided; no public exploit identified at time of analysis. Exploitation likelihood increased by low attack complexity (CVSS AC:L) requiring only basic social engineering to deliver malicious files.
RCE
Denial Of Service
Use After Free
Memory Corruption
-
CVE-2026-27282
HIGH
CVSS 7.5
Security feature bypass in Adobe ColdFusion 2023.18, 2025.6, and earlier allows remote unauthenticated attackers to circumvent security controls via improper input validation, potentially enabling unauthorized access to protected resources. The vulnerability carries a CVSS score of 7.5 with high integrity impact, though exploitation reportedly requires user interaction per the description. No public exploit code or active exploitation confirmed at time of analysis, but the authentication bypass classification indicates potential for privilege escalation or access control circumvention.
Authentication Bypass
-
CVE-2026-27238
HIGH
CVSS 7.8
Heap-based buffer overflow in Adobe InDesign Desktop 20.5.2, 21.2 and earlier enables arbitrary code execution with high confidentiality, integrity, and availability impact. Attack requires local access and user interaction (victim opens malicious InDesign file), with low attack complexity and no authentication barriers. CVSS 7.8 reflects significant impact once social engineering succeeds. No CISA KEV listing indicates no confirmed active exploitation at time of analysis. Adobe has published security advisory APSB26-32 addressing this vulnerability.
RCE
Buffer Overflow
Heap Overflow
-
CVE-2026-26184
HIGH
CVSS 7.8
Windows Projected File System buffer over-read allows authenticated local attackers with low privileges to escalate to high integrity, potentially achieving SYSTEM-level access across Windows 10, Windows 11, and Windows Server platforms. This CWE-126 memory disclosure vulnerability scores 7.8 CVSS with straightforward exploitation (low complexity, no user interaction), affecting extensive Windows infrastructure from legacy 1809 through current 26H1 builds. No public exploit identified at time of
Buffer Overflow
Microsoft
-
CVE-2026-26183
HIGH
CVSS 7.8
Windows RPC API privilege escalation affects all supported Windows Server versions (2012 through 2025) due to improper access control (CWE-284). Low-privileged local attackers can achieve complete system compromise (high confidentiality, integrity, and availability impact) with low attack complexity and no user interaction required. Vendor-released patches are available across all affected Server Core and standard installations. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and clear attack path increase weaponization risk.
Authentication Bypass
Microsoft
-
CVE-2026-26182
HIGH
CVSS 7.0
Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated low-privilege users to gain SYSTEM-level access through use-after-free memory corruption. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, including Server Core installations. Vendor-released patches available across all affected platforms. No public exploit identified at time of analysis, though high-complexity local exploitation (CVSS AC:H)
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-26181
HIGH
CVSS 7.8
Local privilege escalation in Microsoft Brokering File System on Windows 11 and Windows Server 2022/2025 allows authenticated users with low privileges to gain SYSTEM-level access via use-after-free memory corruption. The vulnerability affects all actively supported Windows 11 versions (22H3 through 26H1) and recent Windows Server editions. Exploitation requires local access and low-level user privileges (PR:L) but has low attack complexity (AC:L), enabling reliable exploitation once local access is obtained. No public exploit identified at time of analysis, though the use-after-free weakness class is well-understood by attackers.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-26180
HIGH
CVSS 7.8
Heap-based buffer overflow in the Windows Kernel enables local privilege escalation to SYSTEM on Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server (2012 through 2025). Authenticated local attackers with low privileges can exploit this memory corruption vulnerability to gain complete system control. Microsoft has released patches addressing 21 affected product versions. No public exploit identified at time of analysis, though the local attack vec
Buffer Overflow
Heap Overflow
Microsoft
-
CVE-2026-26179
HIGH
CVSS 7.8
Local privilege escalation in the Windows Kernel via double free vulnerability enables low-privileged authenticated users to gain SYSTEM-level access across Windows 11 (versions 22H3 through 26H1) and Windows Server 2022/2025. The vulnerability requires local access and low privileges (PR:L) but presents low attack complexity (AC:L) with no user interaction required. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the straightforward attack complexity and severe impact make this a priority for patching in enterprise environments.
Information Disclosure
Microsoft
-
CVE-2026-26178
HIGH
CVSS 8.8
Integer size truncation in Windows Advanced Rasterization Platform (WARP) enables unauthenticated remote attackers to achieve code execution with elevated privileges across Windows 10, 11, and Server editions by persuading users to interact with malicious content. Microsoft has released security updates addressing this vulnerability across all supported Windows versions. No public exploit identified at time of analysis, though the unauthenticated remote attack vector (CVSS AV:N/PR:N) combined wi
Authentication Bypass
Microsoft
-
CVE-2026-26177
HIGH
CVSS 7.0
Local privilege escalation in Windows Ancillary Function Driver for WinSock affects all supported Windows 10, 11, and Server versions through use-after-free memory corruption. Authenticated local attackers with low privileges can exploit this CWE-416 vulnerability to gain SYSTEM-level access, achieving high impact to confidentiality, integrity, and availability. Vendor-released patches are available across all affected platforms. No public exploit identified at time of analysis, though the high
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-26176
HIGH
CVSS 7.8
Local privilege escalation in Windows Client Side Caching driver (csc.sys) allows authenticated users with low privileges to gain SYSTEM-level access via heap-based buffer overflow exploitation. Affects all supported Windows 10, Windows 11, and Windows Server versions (2012 through 2025). Vendor-released patches are available from Microsoft as of early 2026. No public exploit identified at time of analysis, though the straightforward attack complexity (AC:L) and no user interaction requirement (
Buffer Overflow
Heap Overflow
Microsoft
-
CVE-2026-26174
HIGH
CVSS 7.0
Windows Server Update Service (WSUS) race condition enables local privilege escalation to SYSTEM on Windows 10, 11, and Server 2012-2025. Authenticated users with low-level privileges can exploit improper synchronization in concurrent execution paths to gain full system control. Attack complexity is high (AC:H), requiring precise timing to win the race window. Vendor-released patches available for all affected versions. No public exploit identified at time of analysis, though the high CVSS 7.0 s
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-26173
HIGH
CVSS 7.0
Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) across Windows 10, 11, and Server 2012-2025 allows low-privileged authenticated attackers to gain SYSTEM-level access via race condition exploitation. The vulnerability affects widespread Windows deployments spanning a decade of operating system versions, from Server 2012 (6.2.9200.0) through Windows 11 26H1 and Server 2025. Microsoft has released patches for all affected versions. No public exploit identified
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-26172
HIGH
CVSS 7.8
Local privilege escalation in Windows Push Notifications service affects Windows 10 21H2/22H2, Windows 11 22H3-26H1, and Windows Server 2022/2025 via race condition vulnerability. Authenticated low-privilege attackers can gain SYSTEM-level privileges through improper synchronization during concurrent operations (CWE-362). CVSS 7.8 (High) with high attack complexity (AC:H) and scope change (S:C). No public exploit identified at time of analysis. Microsoft released patches in January 2026 security
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-26171
HIGH
CVSS 7.5
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust system resources through network-based uncontrolled resource consumption. Affects .NET 8.0 versions prior to 8.0.26, .NET 9.0 versions prior to 9.0.15, and .NET 10.0 versions prior to 10.0.6. Microsoft has released patches addressing CWE-400 resource exhaustion. No evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the network-accessible, unauthenticated attack vector and low complexity (CVSS AV:N/AC:L/PR:N) present significant availability risk for internet-facing .NET applications.
Denial Of Service
-
CVE-2026-26170
HIGH
CVSS 7.8
Microsoft PowerShell privilege escalation affecting Windows 10/11 and Server 2016-2025 allows authenticated local attackers with low privileges to gain SYSTEM-level access through improper input validation (CWE-20). The vulnerability has a CVSS score of 7.8 with low attack complexity and requires no user interaction, enabling straightforward exploitation by any standard user account. No public exploit identified at time of analysis, though the attack vector's simplicity (AV:L/AC:L/PR:L/UI:N) sug
Information Disclosure
Microsoft
-
CVE-2026-26168
HIGH
CVSS 7.8
Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated attackers with low privileges to gain SYSTEM-level access through a race condition vulnerability. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Vendor-released patches available across all affected product lines. Attack complexity rated high (AC:H) but enables full system compromise with changed scope (S:C), indicating container/hypervisor escape potential. No public exploit identified at time of analysis, though the race condition class (CWE-362) is well-understood by exploit developers.
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-26167
HIGH
CVSS 8.8
Local privilege escalation in Windows Push Notifications across Windows 10/11 and Server 2016-2025 allows low-privileged authenticated users to gain SYSTEM-level access via race condition exploitation. The vulnerability affects all currently supported Windows versions with confirmed vendor patches available. Attack complexity is low with no user interaction required, enabling straightforward exploitation once local access is obtained. The scope change (S:C) indicates the attacker can impact reso
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-26166
HIGH
CVSS 7.0
Local privilege escalation in Windows Shell via double-free memory corruption allows low-privileged authenticated users to gain SYSTEM-level access across Windows 11 (versions 22H3 through 26H1) and Windows Server 2022/2025 environments. The CWE-415 double-free vulnerability requires high attack complexity but no user interaction, enabling complete system compromise once exploited. Vendor-released patches are available with specific build numbers identified for each affected version. No public exploit identified at time of analysis, though the CVSS 7.0 score reflects significant impact potential when successfully exploited.
Information Disclosure
Microsoft
-
CVE-2026-26165
HIGH
CVSS 7.0
Windows Shell use-after-free memory corruption enables local privilege escalation to SYSTEM on Windows 11 (all versions 22H3 through 26H1) and Windows Server 2022/2025. Authenticated low-privileged users can exploit freed memory references in Shell components despite high attack complexity requirements. Vendor-released patches address all affected versions. EPSS data not available; no public exploit identified at time of analysis, though the vulnerability class (CWE-416) is well-understood and commonly weaponized in Windows privilege escalation chains.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-26163
HIGH
CVSS 7.8
Windows Kernel double free vulnerability enables local privilege escalation across Windows 10, 11, and Server editions when exploited by authenticated users with low-level privileges. The CWE-415 flaw affects all currently supported Windows versions from legacy Windows Server 2012 R2 through the latest Windows 11 26H1 and Windows Server 2025 builds. With CVSS 7.8 (AV:L/AC:L/PR:L), the vulnerability requires only local access and low-privilege authentication, making it valuable for second-stage a
Information Disclosure
Microsoft
-
CVE-2026-26162
HIGH
CVSS 7.8
Type confusion in Windows OLE (Object Linking and Embedding) enables authenticated local attackers to escalate privileges across all supported Windows 10, 11, and Server versions (2012-2025). The memory corruption flaw allows low-privileged users to execute code with elevated permissions through incompatible type handling. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and lack of user interaction (UI:N) make this accessible to attackers with basic local access.
Information Disclosure
Memory Corruption
Microsoft
-
CVE-2026-26161
HIGH
CVSS 7.8
Local privilege escalation in Windows Sensor Data Service affects all supported Windows 10, Windows 11, and Windows Server versions through untrusted pointer dereference (CWE-822). Authenticated local attackers with low-privilege accounts can exploit this vulnerability with low complexity to gain SYSTEM-level privileges, achieving full compromise of confidentiality, integrity, and availability. Vendor-released patches are available across all affected product lines. No public exploit identified
Information Disclosure
Microsoft
-
CVE-2026-26160
HIGH
CVSS 7.8
Local privilege escalation in Windows Remote Desktop Licensing Service affects all supported Windows 10, Windows 11, and Windows Server versions (2012-2025) via missing authentication on a critical function. Authenticated local attackers with low privileges can exploit this CWE-306 authentication bypass to gain SYSTEM-level access with high impact to confidentiality, integrity, and availability (CVSS 7.8). Patch available per vendor; no public exploit identified at time of analysis. The wide foo
Authentication Bypass
Microsoft
-
CVE-2026-26159
HIGH
CVSS 7.8
Local privilege escalation in Windows Remote Desktop Licensing Service (affecting Windows 10 1607 through Windows Server 2025) allows low-privileged authenticated users to gain SYSTEM-level access by exploiting missing authentication on critical service functions. The vulnerability (CWE-306) requires local access and low-privilege credentials but enables complete system compromise with low attack complexity. Vendor-released patches are available across all affected Windows versions. No public ex
Authentication Bypass
Microsoft
-
CVE-2026-26156
HIGH
CVSS 7.8
Heap-based buffer overflow in Windows Hyper-V enables local code execution with high impact across Windows 10, Windows 11, and Windows Server environments. An unauthenticated attacker with local access can trigger the vulnerability through user interaction (CVSS:3.1 AV:L/AC:L/PR:N/UI:R), achieving full system compromise (C:H/I:H/A:H). Microsoft has released patches addressing 17 affected Windows versions ranging from legacy Windows 10 1607 through Windows 11 26H1 and Windows Server 2025. No publ
Buffer Overflow
Heap Overflow
Microsoft
-
CVE-2026-26154
HIGH
CVSS 7.5
Windows Server Update Service (WSUS) fails to properly validate network inputs, allowing unauthenticated remote attackers to cause denial of service across all Windows Server versions from 2012 through 2025. The vulnerability (CVSS 7.5) enables network-based tampering with high availability impact (AV:N/AC:L/PR:N/UI:N/A:H), though confidentiality and integrity remain unaffected. Patch available per vendor advisory; no public exploit identified at time of analysis. The Authentication Bypass tag and PR:N vector confirm attackers require no credentials, making internet-exposed WSUS servers particularly vulnerable.
Authentication Bypass
Microsoft
-
CVE-2026-26153
HIGH
CVSS 7.8
Out-of-bounds read in Windows Encrypting File System (EFS) enables low-privileged local attackers to escalate to SYSTEM privileges on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025. The vulnerability (CWE-125) requires local access and low-level privileges but no user interaction, yielding complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 7.8). Vendor-released patches are available
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-26152
HIGH
CVSS 7.0
Local privilege escalation in Windows Cryptographic Services affects Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 due to insecure storage of cryptographic material. Authenticated attackers with low privileges can exploit this CWE-922 weakness (insecure storage of sensitive information) to gain high-level access to confidentiality, integrity, and availability. Microsoft has released patches for all affected versions. No public exploit identified at time of analysis,
Information Disclosure
Microsoft
-
CVE-2026-26151
HIGH
CVSS 7.1
Windows Remote Desktop spoofing vulnerability allows remote unauthenticated attackers to bypass security warnings and trick users into accepting malicious RDP connections, potentially exposing sensitive session data. Affects all supported Windows 10, 11, and Server versions from 2012 through 2025. Vendor-released patches are available. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and network attack vector (AV:N) indicate exploitation would be straight
Authentication Bypass
Microsoft
-
CVE-2026-26143
HIGH
CVSS 7.8
Authentication bypass in Microsoft PowerShell 7.4 (versions prior to 7.4.14) and 7.5 (versions prior to 7.5.5) allows local attackers to bypass security features through improper input validation. The vulnerability requires user interaction but no authentication (PR:N), enabling attackers to achieve high impact across confidentiality, integrity, and availability. Microsoft has released patches addressing this security feature bypass. EPSS data not available; no confirmed active exploitation (CISA KEV) identified at time of analysis.
Authentication Bypass
Microsoft
-
CVE-2026-25654
HIGH
CVSS 8.7
SINEC NMS versions prior to V4.0 SP3 allow authenticated remote attackers to reset any user account password due to improper authorization validation (CWE-639). An attacker with low-privilege credentials can escalate to administrative access by resetting privileged user passwords, enabling complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit code identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) increase exploitation feasibility for authenticated attackers.
Authentication Bypass
-
CVE-2026-25184
HIGH
CVSS 7.0
Race condition in Microsoft AppLocker Filter Driver (applockerfltr.sys) allows local authenticated users with low privileges to elevate to SYSTEM through improper synchronization of shared resources. Affects Windows 11 (22H2 through 26H1) and Windows Server 2022/2025 editions. Vendor-released patch available as of April 2025 security updates. CVSS 7.0 reflects high attack complexity but complete system compromise if successful. No public exploit identified at time of analysis, though the local privilege escalation vector makes this valuable for post-compromise lateral movement in enterprise environments.
Information Disclosure
Race Condition
-
CVE-2026-24893
HIGH
CVSS 8.8
Remote code execution in openITCOCKPIT Community Edition (versions prior to 5.5.2) allows authenticated users with host management permissions to execute arbitrary OS commands on the monitoring backend via command injection in host address fields. The vulnerability stems from unsanitized user input being expanded into Nagios/Icinga monitoring command templates and executed via shell, enabling full system compromise. CVSS score of 8.8 reflects network-accessible attack with low complexity requiring only low-privilege authentication. No public exploit identified at time of analysis, with EPSS data unavailable for this recently disclosed CVE.
RCE
Command Injection
-
CVE-2026-23708
HIGH
CVSS 7.5
Authentication bypass in Fortinet FortiSOAR allows unauthenticated remote attackers to circumvent two-factor authentication (2FA) protections via replay attacks against intercepted authentication tokens. Affects both PaaS and on-premise deployments of FortiSOAR versions 7.5.0-7.5.2 and 7.6.0-7.6.3. Successful exploitation requires network positioning to intercept and decrypt authentication traffic, then replay captured 2FA requests before token expiration (CVSS:3.1/AV:N/AC:H/PR:N/UI:R). EPSS data not available; no public exploit code or CISA KEV listing identified at time of analysis, though the precise attack requirements (traffic interception, decryption, timing) increase complexity beyond simple network access.
Authentication Bypass
Fortinet
-
CVE-2026-23666
HIGH
CVSS 7.5
Denial of service in Microsoft .NET Framework 3.5 through 4.8.1 allows unauthenticated remote attackers to crash applications via race condition exploitation over a network. The vulnerability stems from improper synchronization when multiple threads access shared resources concurrently (CWE-755). Affected versions span .NET Framework 3.5, 4.6.2, 4.7.x, 4.8, and 4.8.1 across multiple component combinations. Microsoft has released patches addressing the flaw. No public exploit code or active explo
Authentication Bypass
-
CVE-2026-23657
HIGH
CVSS 7.8
Local code execution in Microsoft Office Word via use-after-free memory corruption affects Microsoft 365 Apps for Enterprise and Office LTSC 2024. Unauthenticated attackers can achieve full system compromise (confidentiality, integrity, availability) by inducing users to open specially crafted Word documents, triggering memory reuse vulnerabilities during document parsing. Vendor patch available via Microsoft Security Response Center. No public exploit identified at time of analysis, though CVSS 7.8 indicates high severity when user interaction occurs.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-22828
HIGH
CVSS 8.1
Remote code execution in Fortinet FortiAnalyzer Cloud and FortiManager Cloud versions 7.6.2 through 7.6.4 allows unauthenticated remote attackers to execute arbitrary code via crafted network requests exploiting a heap-based buffer overflow (CWE-122). Attack complexity is rated high due to ASLR and network segmentation defenses requiring significant exploitation preparation. CVSS score of 8.1 reflects the critical impact despite defensive barriers. No public exploit identified at time of analysis, though the vulnerability's disclosure by Fortinet suggests patch availability through their security advisory FG-IR-26-121.
RCE
Buffer Overflow
Fortinet
Heap Overflow
-
CVE-2026-20930
HIGH
CVSS 7.8
Privilege escalation in Windows Management Services (all supported Windows 10/11 and Server versions) allows authenticated local attackers with low privileges to gain high-level system access via race condition exploitation. Vendor-released patches are available for all affected versions. CVSS score of 7.8 reflects high complexity attack requiring precise timing but enabling full system compromise with changed scope. No public exploit identified at time of analysis, though the race condition cla
Information Disclosure
Race Condition
Microsoft
-
CVE-2026-6227
HIGH
CVSS 7.2
Local file inclusion in BackWPup WordPress plugin versions ≤5.6.6 allows authenticated administrators to read sensitive configuration files or achieve remote code execution via path traversal bypass in the `/wp-json/backwpup/v1/getblock` REST endpoint. The vulnerability stems from insufficient sanitization using non-recursive `str_replace()`, enabling crafted sequences like `....//` to bypass filtering. While requiring high privileges (PR:H), the plugin's permission delegation feature allows administrators to grant backup management rights to lower-privileged users, expanding the attack surface. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CVSS 7.2 reflects high confidentiality, integrity, and availability impact.
PHP
WordPress
RCE
Path Traversal
-
CVE-2026-5756
HIGH
CVSS 7.5
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.
Information Disclosure
Microsoft
-
CVE-2026-4388
HIGH
CVSS 7.2
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers to inject malicious JavaScript through Matrix field submissions that executes when administrators view submission details. The vulnerability stems from inadequate sanitization (sanitize_text_field removes tags but preserves quotes) and missing output escaping in the admin Submissions view. With CVSS 7.2 (High) and network-based attack vector requiring no privileges or user int
WordPress
XSS
-
CVE-2026-4369
HIGH
CVSS 7.1
Stored cross-site scripting in Autodesk Fusion desktop application enables arbitrary code execution when malicious assembly variant names render in delete confirmation dialogs. Attackers can craft HTML payloads that execute in the application context, enabling local file access and code execution with user privileges (CVSS 7.1, local attack vector requiring user interaction). Vendor-released patch available via official Fusion client installers for Windows and macOS. No public exploit identified at time of analysis.
XSS
RCE
-
CVE-2026-4352
HIGH
CVSS 7.5
SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote attackers to extract sensitive database information. The vulnerability stems from unsanitized search parameters in REST endpoints, bypassing WordPress's built-in SQL protections. Attack complexity is low (CVSS AC:L) with no user interaction required. EPSS and KEV data not provided; exploitation requires Custom Content Types module enabled with public REST endpoints configured.
WordPress
SQLi
-
CVE-2026-4345
HIGH
CVSS 7.1
Stored cross-site scripting (XSS) in Autodesk Fusion desktop application allows local attackers to execute arbitrary code or read local files by crafting malicious HTML payloads in design names that trigger when exported to CSV format. The vulnerability requires no authentication but depends on user interaction (opening the exported CSV). Vendor patch available via updated client installers for Windows and macOS. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code identified at time of analysis.
XSS
RCE
-
CVE-2026-4344
HIGH
CVSS 7.1
Stored XSS in Autodesk Fusion desktop application allows local attackers to execute arbitrary code or read local files through malicious component names displayed in delete confirmation dialogs. When a user clicks the crafted payload, the vulnerability escalates from XSS to potential local code execution within the application context. Vendor-released patches available for Windows and macOS. No public exploit identified at time of analysis, though the attack vector is local (CVSS:3.1/AV:L) requiring user interaction but no authentication (PR:N), with CVSS 7.1 reflecting high confidentiality and integrity impact.
XSS
RCE
-
CVE-2026-3017
HIGH
CVSS 7.2
PHP object injection in Smart Post Show WordPress plugin versions ≤3.0.12 allows administrators to deserialize untrusted input via the import_shortcodes() function. While no POP chain exists in the plugin itself (making direct exploitation impossible), the vulnerability becomes critical if paired with another plugin/theme containing exploitable gadget chains, potentially enabling file deletion, data exfiltration, or remote code execution. CVSS 7.2 (High) reflects theoretical maximum impact. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE identifier.
PHP
WordPress
Information Disclosure
Deserialization
-
CVE-2026-2450
HIGH
CVSS 7.4
Misconfigured .NET impersonation in upKeeper Instant Privilege Access through version 1.5.0 enables authenticated remote attackers to hijack privileged execution threads, leading to high confidentiality and integrity impact on underlying system resources. The vulnerability requires low-level privileges and presents network-based attack vector with high complexity. No public exploit identified at time of analysis, and CISA SSVC framework classifies this as non-automatable with partial technical impact. EPSS data not available for risk quantification.
Information Disclosure
-
CVE-2026-2332
HIGH
CVSS 7.4
HTTP request smuggling in Eclipse Jetty versions 9.4.0-12.1.6 allows remote unauthenticated attackers to inject smuggled requests via malformed chunked transfer encoding. The HTTP/1.1 parser incorrectly terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as a protocol violation, enabling 'funky chunks' smuggling techniques. This affects all major Jetty version branches (9.4.x, 10.0.x, 11.0.x, 12.0.x, and 12.1.x). EPSS data not available, no confirmed active exploitation (CISA KEV negative), but publicly documented attack techniques exist.
Code Injection
Request Smuggling
-
CVE-2026-0207
HIGH
CVSS 8.5
Information disclosure in Pure Storage FlashBlade allows high-privileged network attackers to access sensitive data through log files. Affects FlashBlade versions 4.0.0-4.4.8, 4.5.0-4.5.13, and 4.6.0-4.6.3. The vulnerability (CWE-532: insertion of sensitive information into log file) has a CVSS 4.0 score of 8.5, indicating high confidentiality impact with scope change, but requires high privileges. No public exploit or active exploitation confirmed at time of analysis. EPSS data not yet available for this recently disclosed CVE.
Information Disclosure
-
CVE-2025-61848
HIGH
CVSS 7.2
SQL injection in Fortinet FortiAnalyzer and FortiManager versions 7.0-7.6 allows privileged authenticated attackers to execute unauthorized code or commands via the JSON RPC API. This affects both on-premises and cloud variants across multiple major version branches (7.0, 7.2, 7.4, 7.6). The vulnerability requires high-privilege authentication (CVSS PR:H) but is remotely exploitable with low attack complexity. No public exploit identified at time of analysis, though the network attack vector and code execution capability make this a priority for organizations running affected Fortinet management infrastructure.
Fortinet
SQLi
-
CVE-2025-7389
HIGH
CVSS 8.2
Progress OpenEdge AdminServer exposes authenticated RMI methods allowing arbitrary file reads with escalated OS privileges across versions 12.2.0-12.2.18. Authenticated administrators can abuse setFile() and openFile() RMI methods to read sensitive files beyond their intended access level, leveraging the AdminServer process's elevated system permissions. EPSS data not available; no CISA KEV listing indicates no confirmed active exploitation, though SSVC marks exploitation status as 'none' with partial technical impact. The vulnerable methods have been removed in patched versions.
Information Disclosure
Path Traversal
-
CVE-2026-40883
MEDIUM
CVSS 6.1
### Summary
goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as `?delete` and `?mkdir` because goshs relies on HTTP basic auth alone and performs no CSRF, `Orig...
Google
CSRF
Node.js
Apple
Suse
-
CVE-2026-40320
MEDIUM
CVSS 5.4
Remote code execution in giskard-checks through server-side template injection (SSTI) in the ConformityCheck class allows arbitrary Python code execution when the rule parameter is processed via unsandboxed Jinja2 template rendering. Affected versions prior to 1.0.2b1 silently interpret rule strings as Jinja2 templates, enabling attackers with write access to check definitions or configuration files to inject malicious template expressions that execute during test suite execution. Exploitation requires local file write access and subsequent developer execution of the test suite, but the implicit template evaluation increases risk when untrusted check definitions are integrated from shared projects or external sources.
RCE
Python
Ssti
-
CVE-2026-40255
MEDIUM
CVSS 6.1
Open redirect vulnerability in AdonisJS @adonisjs/http-server allows unauthenticated remote attackers to redirect users to arbitrary external sites by manipulating the Referer HTTP header via the response.redirect().back() method. The vulnerability affects all AdonisJS applications using the back() redirect functionality and has been patched in version 8.2.0, which implements host validation against the incoming request's Host header. User interaction (clicking a malicious link) is required for exploitation, and no public exploit code or active exploitation has been identified.
Open Redirect
-
CVE-2026-40249
MEDIUM
CVSS 6.9
Free5GC UDR service fails to terminate request processing after HTTP body retrieval or JSON deserialization errors in the PUT /nudr-dr/v2/policy-data/subs-to-notify/{subsId} endpoint, allowing unintended modification of Policy Data notification subscriptions with invalid or partially processed input. The handler lacks return statements following error responses, causing execution to continue to the downstream processor with uninitialized or empty subscription objects. No public exploit code or active exploitation has been confirmed; this is a robustness and input validation flaw affecting write operations on a core 5G network function.
Deserialization
-
CVE-2026-40105
MEDIUM
CVSS 6.5
Reflected cross-site scripting (XSS) in XWiki's compare view allows unauthenticated attackers to execute arbitrary JavaScript in a user's browser by injecting malicious code through unescaped URL parameters in the page revision comparison feature. When the victim is an administrator, successful exploitation compromises the confidentiality, integrity, and availability of the entire XWiki instance. Vendor-released patch is available; no public exploit code or active exploitation has been confirmed at time of analysis.
XSS
-
CVE-2026-40104
MEDIUM
CVSS 6.9
Denial of service via resource exhaustion in XWiki REST API endpoints that list database properties without respecting configured query limits, allowing remote attackers to enumerate all pages on large wiki installations and exhaust server resources. Affects XWiki Platform versions before 16.10.16, 17.4.8, and 17.10.1. Vendor-released patches are available; no public exploit code or active exploitation confirmed at time of analysis.
Denial Of Service
-
CVE-2026-40096
MEDIUM
CVSS 5.1
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared album names that inject unsanitized HTML into Open Graph meta tags, redirecting victims' browsers to attacker-controlled sites when they open the share link. This enables phishing attacks where victims can be directed to credential-harvesting sites that impersonate the Immich login interface, exploiting user trust in the shared album feature.
XSS
Open Redirect
-
CVE-2026-40091
MEDIUM
CVSS 6.0
SpiceDB information disclosure vulnerability in startup logging allows high-privileged local attackers to obtain plaintext database passwords. When SpiceDB initializes at info log level, the startup configuration log message exposes the complete datastore DSN string containing unmasked credentials in the DatastoreConfig.URI field. Patch version 1.51.1 available; CVSS 6.0 reflects high confidentiality impact mitigated by high privilege requirement and local-only attack vector.
Information Disclosure
-
CVE-2026-39984
MEDIUM
CVSS 5.5
Authorization bypass in sigstore/timestamp-authority verifier allows attackers to prepend forged certificates to PKCS#7 certificate bags, causing the library to validate signatures with one certificate while performing authorization checks on another. The vulnerability affects the `VerifyTimestampResponse` function in timestamp-authority/v2/pkg/verification, enabling attackers to bypass authorization controls on timestamp verification. This impacts only library consumers, not the timestamp-authority service itself, and sigstore-go is unaffected due to its use of the `TSACertificate` mitigation option. EPSS 5.5, actively exploitable via local interaction.
Authentication Bypass
Suse
-
CVE-2026-39963
MEDIUM
CVSS 6.9
Serendipity's serendipity_setCookie() function accepts unsanitized HTTP_HOST header values as the cookie domain parameter, allowing remote attackers to scope authentication cookies (session tokens, auto-login tokens) to attacker-controlled domains and facilitate session hijacking. The vulnerability requires user interaction (victim authentication during poisoned Host header) and man-in-the-middle or reverse proxy misconfiguration to exploit, affecting all versions of Serendipity that use the vulnerable function. A proof-of-concept demonstrating cookie domain poisoning exists; exploitation probability is moderate (EPSS 6.9, CVSS AC:H reflects attack complexity), and no evidence of active exploitation has been identified.
PHP
Privilege Escalation
-
CVE-2026-39814
MEDIUM
CVSS 6.7
Local privilege escalation in Fortinet FortiWeb 7.0.10-8.0.2 allows high-privileged local attackers to execute arbitrary code or commands through relative path traversal, exploiting improper file path validation with CVSS 6.7 (high confidentiality, integrity, and availability impact). No public exploit code or active exploitation confirmed at time of analysis.
Path Traversal
Fortinet
-
CVE-2026-39812
MEDIUM
CVSS 4.8
Stored cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 4.2 through 5.0.5 allows authenticated administrators with high privileges to inject malicious scripts into web pages, leading to unauthorized code execution when other users interact with compromised content. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity but not availability. With a CVSS score of 4.8 and high privilege requirement (PR:H), this represents a moderate risk primarily to multi-user deployments where administrative accounts may be compromised or untrusted.
XSS
Fortinet
-
CVE-2026-39811
MEDIUM
CVSS 4.9
Denial of service in Fortinet FortiWeb 7.0-8.0.3 via integer overflow allows authenticated remote attackers with high privileges to crash the application, resulting in service unavailability. The vulnerability has a CVSS score of 4.9 (Medium) and affects multiple FortiWeb versions across a wide range. No public exploit code or active exploitation has been confirmed at the time of analysis.
Denial Of Service
Fortinet
Integer Overflow
-
CVE-2026-39810
MEDIUM
CVSS 6.0
Hard-coded cryptographic keys in Fortinet FortiClientEMS 7.4.0 through 7.4.5 allow local authenticated attackers with high privileges to disclose sensitive information and potentially modify system configurations. An attacker with administrative access can extract or leverage these embedded keys to compromise confidentiality and integrity of protected data. This vulnerability requires local access and elevated privileges, limiting but not eliminating real-world risk in multi-user or compromised endpoint scenarios.
Information Disclosure
Fortinet
-
CVE-2026-39809
MEDIUM
CVSS 6.7
SQL injection in Fortinet FortiClientEMS 7.0 through 7.4.5 allows high-privileged local attackers to execute unauthorized code or commands with high integrity and confidentiality impact. The vulnerability requires local access and high privileges (PR:H per CVSS vector), making it a risk primarily in environments where administrative users are untrusted or compromised. CISA SSVC framework rates this as non-exploitable via automation due to privilege requirements, though the technical impact is total (confidentiality, integrity, and availability compromise). No public exploit code has been identified at the time of analysis.
Fortinet
SQLi
-
CVE-2026-39426
MEDIUM
CVSS 5.1
Stored Cross-Site Scripting in MaxKB's MdRenderer component allows authenticated users to inject malicious scripts via custom <iframe_render> tags in LLM responses or Application Prologue configurations, leading to JavaScript execution in the parent window context with access to session tokens and sensitive data. MaxKB versions 2.7.1 and earlier are affected; the vulnerability is fixed in version 2.8.0. The attack requires user interaction (UI:P) but impacts all visitors to an affected application's chat interface, making it a high-impact stored XSS despite the moderate CVSS 5.1 score.
XSS
Information Disclosure
-
CVE-2026-39425
MEDIUM
CVSS 5.1
Stored Cross-Site Scripting in MaxKB 2.7.1 and below allows authenticated users to inject arbitrary JavaScript into the Application prologue field via <html_rander> tags, which the backend stores unsanitized and the frontend renders with innerHTML-equivalent mechanisms. Exploitation enables session hijacking, unauthorized workspace/application deletion, and sensitive data exposure against any visitor accessing the affected chatbot. Fixed in version 2.8.0.
XSS
Information Disclosure
-
CVE-2026-39424
MEDIUM
CVSS 5.3
MaxKB versions 2.7.1 and below allow authenticated administrators to trigger arbitrary code execution on their own workstations through improper CSV formula sanitization in the chat export feature. When exporting chat history to Excel via the /admin/api/workspace/{workspace_id}/application/{application_id}/chat/export endpoint, formula strings (e.g., =cmd|'/c calc'!A1) are written unsanitized to the .xlsx file, enabling Dynamic Data Exchange (DDE) exploitation when the file is opened in Microsoft Excel. No public exploit code has been identified, but the vulnerability represents a high-impact attack path for administrators with legitimate export access and is a direct repeat of a previously patched flaw (CVE-2025-4546) that was incompletely remediated across the codebase.
RCE
Microsoft
-
CVE-2026-39423
MEDIUM
CVSS 6.9
Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to execute arbitrary JavaScript in other users' browsers, including administrators. MaxKB versions 2.7.1 and below are affected. The vulnerability requires user interaction (UI:P) and low privileges (PR:L) to exploit, but delivers high integrity impact (VI:H) to victim sessions. A vendor-released patch is available in version 2.8.0.
XSS
-
CVE-2026-39422
MEDIUM
CVSS 6.9
Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript through application name or icon fields, which is then executed in victims' browsers when accessing the public chat interface. The vulnerability stems from unsanitized data insertion into HTML responses by ChatHeadersMiddleware, enabling arbitrary code execution with user interaction. MaxKB 2.8.0 has released a patch to fix this issue.
XSS
-
CVE-2026-39421
MEDIUM
CVSS 6.3
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by exploiting a sandbox escape vulnerability in the ToolExecutor component. By leveraging Python's ctypes library to invoke raw system calls and bypassing the LD_PRELOAD-based sandbox.so module through the unblocked pkey_mprotect syscall, attackers can achieve remote code execution, enabling network exfiltration and container compromise. This vulnerability is confirmed fixed in version 2.8.0, and no public exploit code has been identified at time of analysis.
RCE
Python
-
CVE-2026-39420
MEDIUM
CVSS 6.3
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based sandbox via the env command, enabling unrestricted remote code execution and network access. The vulnerability stems from a patch that permitted execution of /usr/bin/env, which attackers can exploit using env -i to clear environment variables and drop the sandbox.so hook before spawning a native Python subprocess. Vendor-released patch: version 2.8.0.
RCE
Python
-
CVE-2026-39418
MEDIUM
CVSS 5.0
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
Linux
SSRF
-
CVE-2026-39417
MEDIUM
CVSS 4.6
Remote code execution in MaxKB workflow engine (versions 2.7.1 and below) allows authenticated users to bypass an incomplete CVE-2025-53928 fix by injecting arbitrary MCP node configurations through the workflow creation API. An attacker with low-privilege credentials can omit the mcp_source field to trigger the unpatched else branch, inject stdio transport with arbitrary commands, and achieve RCE when the workflow is executed via chat interaction. This represents an incomplete remediation of a prior vulnerability-the patch restricted one code path but left an alternative execution path fully exposed.
RCE
-
CVE-2026-38533
MEDIUM
CVSS 6.5
An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.
Authentication Bypass
-
CVE-2026-37980
MEDIUM
CVSS 6.9
Stored XSS in Keycloak's organization selection login page allows authenticated administrators with manage-realm or manage-organizations privileges to inject malicious JavaScript via the organization.alias field, enabling arbitrary script execution in users' browsers when they access the login page. Exploitation requires high-privilege administrative access and user interaction (viewing the login page), with potential impact including session theft and unauthorized account actions. No public exploit code or active exploitation confirmed at time of analysis.
XSS
Red Hat
-
CVE-2026-35034
MEDIUM
CVSS 6.5
Denial of service in Jellyfin versions prior to 10.11.7 allows authenticated users to exhaust server resources and crash the SyncPlay media synchronization service via the group creation endpoint (POST /SyncPlay/New) by submitting unbounded payload sizes. An attacker can lock out legitimate clients from accessing SyncPlay functionality and trigger out-of-memory conditions through insufficient input validation on group names and IDs. No public exploit code or active exploitation has been identified.
Denial Of Service
-
CVE-2026-34626
MEDIUM
CVSS 6.3
Prototype pollution in Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier allows arbitrary file system read operations in the context of the current user when a victim opens a malicious PDF or document. The vulnerability requires user interaction but enables confidentiality compromise with high impact; no active exploitation confirmed but the attack surface is broad given Acrobat Reader's ubiquity in document handling.
Information Disclosure
Adobe
Prototype Pollution
-
CVE-2026-34625
MEDIUM
CVSS 5.4
DOM-based cross-site scripting in Adobe Experience Manager 6.5.24 and earlier allows authenticated attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious webpage that manipulates the DOM environment. The vulnerability requires user interaction and results in limited confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis.
XSS
Adobe
-
CVE-2026-34624
MEDIUM
CVSS 5.4
DOM-based cross-site scripting in Adobe Experience Manager 6.5.24 and FP11.7 earlier allows authenticated users to execute arbitrary JavaScript in victims' browsers by crafting malicious webpages that manipulate the DOM environment. The vulnerability requires user interaction (victim must visit a crafted page) and affects the confidentiality and integrity of user sessions within the AEM application context. CVSS 5.4 reflects the moderate severity; no public exploit code or active exploitation has been confirmed at time of analysis.
XSS
Adobe
-
CVE-2026-34623
MEDIUM
CVSS 5.4
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5.24 and FP11.7 and earlier allows authenticated attackers to execute arbitrary JavaScript in victims' browsers by crafting malicious web pages that manipulate the DOM environment, requiring user interaction to trigger the attack. CVSS 5.4 reflects moderate severity with network-accessible attack surface but limited scope impact. No public exploit code or active exploitation has been confirmed at time of analysis.
XSS
Adobe
-
CVE-2026-34614
MEDIUM
CVSS 6.1
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.
XSS
Adobe
-
CVE-2026-34370
MEDIUM
CVSS 6.5
Chamilo LMS versions prior to 2.0.0-RC.3 allow authenticated students to read private course notes of any other user via an Insecure Direct Object Reference (IDOR) vulnerability in the notebook module's editnote action. An attacker can manipulate the notebook_id parameter to bypass ownership checks in the read path (get_note_information()), exposing note titles and HTML body content despite write-path protections existing in updateNote() and delete_note(). The vulnerability requires valid student credentials but impacts confidentiality of sensitive educational materials across the platform.
Authentication Bypass
-
CVE-2026-34264
MEDIUM
CVSS 6.5
SAP Human Capital Management for SAP S/4HANA allows authenticated users with low privileges to enumerate and guess sensitive information through specific authorization check messages, resulting in information disclosure beyond their authorized scope. The vulnerability affects SAP HCM across affected versions and requires low-privilege authenticated access to exploit, with a CVSS score of 6.5 reflecting high confidentiality impact but no integrity or availability compromise.
Information Disclosure
SAP
-
CVE-2026-34262
MEDIUM
CVSS 5.0
SAP HANA Cockpit and HANA Database Explorer leak sensitive information to authenticated network users due to improper credential storage mechanisms (CWE-522). An authenticated attacker with network access can retrieve confidential data without requiring elevated privileges or user interaction. This vulnerability affects all versions of SAP HANA Cockpit and HANA Database Explorer; patch availability and active exploitation status are not confirmed from available data.
Information Disclosure
SAP
-
CVE-2026-34261
MEDIUM
CVSS 6.5
Missing authorization checks in SAP Business Analytics and SAP Content Management allow authenticated users to invoke unauthorized remote function module calls, enabling confidential data access beyond their assigned permissions. The vulnerability affects all versions of the product and carries a CVSS score of 6.5 with confirmed high confidentiality impact. No public exploit code or active exploitation has been reported at time of analysis.
Authentication Bypass
SAP
-
CVE-2026-34257
MEDIUM
CVSS 6.1
Open redirect in SAP NetWeaver Application Server ABAP allows unauthenticated attackers to craft malicious URLs that redirect victims to attacker-controlled pages, potentially enabling phishing or credential theft attacks. The vulnerability affects all versions of SAP NetWeaver Application Server ABAP and requires user interaction (URL click). CVSS score of 6.1 reflects moderate risk with low confidentiality and integrity impact but no availability impact. No public exploit code or active exploitation has been reported at time of analysis.
Open Redirect
SAP
-
CVE-2026-34225
MEDIUM
CVSS 4.3
Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.
SSRF
-
CVE-2026-34213
MEDIUM
CVSS 5.4
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments belonging to other users within the same workspace via improper authorization checks on the POST /api/files/upload endpoint. An attacker can supply a victim's attachmentId to modify or corrupt files without user interaction, compromising document integrity across the workspace. No public exploit code has been identified; patch version 0.71.0 is available.
Authentication Bypass
-
CVE-2026-34212
MEDIUM
CVSS 5.4
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `javascript:` URLs into attachment nodes, executing arbitrary JavaScript in the browser context of other users who activate those attachments. Attack requires low privileges and user interaction (clicking the attachment), affecting all users viewing compromised pages. The vulnerability has been patched in version 0.71.0.
XSS
-
CVE-2026-34161
MEDIUM
CVSS 5.1
Stored cross-site scripting (XSS) in Chamilo LMS versions prior to 2.0.0-RC.3 allows authenticated users to upload malicious HTML files containing JavaScript via the social post attachment API endpoint. The uploaded files are served without sanitization, content-type restrictions, or proper content-disposition headers, causing embedded JavaScript to execute in the browser within the application's trusted origin. This enables session hijacking, account takeover, and privilege escalation attacks, particularly when an administrator views a malicious link. The vulnerability is confirmed fixed in version 2.0.0-RC.3.
XSS
Privilege Escalation
-
CVE-2026-33929
MEDIUM
CVSS 4.3
Path traversal vulnerability in Apache PDFBox Examples ExtractEmbeddedFiles tool allows authenticated local users to write files outside intended directories via malicious PDF files when the initial path traversal fix fails to properly validate file path separators. Affects PDFBox 2.0.24-2.0.36 and 3.0.0-3.0.7; CVSS 4.3 with low exploitability (EPSS 0.02%, SSVC automation: no). Patch versions 2.0.37 and 3.0.8 address the issue.
Apache
Path Traversal
-
CVE-2026-33892
MEDIUM
CVSS 5.1
Authentication bypass in Siemens Industrial Edge Management systems (Pro V1 ≥1.7.6 <1.15.17, Pro V2 ≥2.0.0 <2.1.1, Virtual ≥2.2.0 <2.8.0) allows unauthenticated remote attackers with user interaction to impersonate legitimate users and tunnel to managed devices when remote connection features are enabled. Exploitation requires knowledge of connection headers and ports but does not bypass device-level application authentication. No public exploit identified at time of analysis. CVSS 7.1 with network attack vector, low complexity, and no authentication required (PR:N), indicating moderate real-world risk for industrial environments with exposed management interfaces.
Information Disclosure
-
CVE-2026-33829
MEDIUM
CVSS 4.3
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.
Information Disclosure
Microsoft
-
CVE-2026-33822
MEDIUM
CVSS 6.1
Out-of-bounds read in Microsoft Office Word enables local information disclosure when a user opens a malicious document, affecting Microsoft 365 Apps for Enterprise and Office LTSC for Mac 2021/2024. The vulnerability requires user interaction (document opening) but does not require elevated privileges, with a CVSS score of 6.1 reflecting moderate severity. Microsoft has released patches addressing this issue across affected product lines.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-33414
MEDIUM
CVSS 4.0
Command injection in Podman's HyperV machine backend allows local administrators with high privileges to execute arbitrary PowerShell commands at SYSTEM level on Windows hosts by crafting a malicious VM image path containing PowerShell subexpression syntax. The vulnerability affects Podman v4 and v5 on Windows only; a vendor patch is available via commit 571c842.
RCE
Command Injection
Microsoft
Suse
-
CVE-2026-33193
MEDIUM
CVSS 4.6
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious scripts through MIME type spoofing, potentially compromising user sessions and data integrity. The vulnerability requires user interaction (clicking a link or viewing injected content) and affects only the confidentiality and integrity of affected users' data, not availability. Vendor-released patch: version 0.70.0.
XSS
-
CVE-2026-33146
MEDIUM
CVSS 4.3
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restricted child page titles and text snippets via the public search endpoint, exposing confidential documentation content that should only be visible to authorized share viewers. This medium-severity confidentiality breach affects any Docmost instance with publicly shared workspaces and requires user interaction (clicking a link or accessing the search interface), but poses significant risk to organizations treating Docmost as a confidential knowledge base.
Authentication Bypass
-
CVE-2026-33103
MEDIUM
CVSS 5.5
Improper access control in Microsoft Dynamics 365 (on-premises) version 9.0 allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability stems from insufficient authorization checks that permit users with low-level privileges to access confidential data through local access vectors. This affects Dynamics 365 on-premises deployments up to version 9.0.0043.x, with vendor-released patches available from Microsoft.
Authentication Bypass
Microsoft
-
CVE-2026-32226
MEDIUM
CVSS 5.9
Denial of service in Microsoft .NET Framework 3.5 and 4.7.2-4.8.1 via race condition in shared resource synchronization allows unauthenticated remote attackers to crash affected applications with high complexity attack requirements. Microsoft has released patches addressing improper concurrent access handling across multiple .NET Framework versions.
Authentication Bypass
Race Condition
-
CVE-2026-32223
MEDIUM
CVSS 6.8
Heap-based buffer overflow in Windows USB Print Driver allows local privilege escalation via physical device access. Affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, with patch available from Microsoft. Attack requires physical USB access and no user interaction; no public exploit identified at time of analysis.
Buffer Overflow
Heap Overflow
Microsoft
-
CVE-2026-32220
MEDIUM
CVSS 4.4
Windows Virtualization-Based Security (VBS) Enclave in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 allows high-privileged local attackers to bypass security features through improper access control, resulting in integrity compromise without requiring user interaction. A vendor-released patch is available from Microsoft's security updates.
Authentication Bypass
Microsoft
-
CVE-2026-32218
MEDIUM
CVSS 5.5
Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2022, and Windows Server 2025. An attacker with local user privileges can access kernel log files to retrieve confidential data such as credentials, cryptographic material, or system secrets. Microsoft has released patches addressing this log injection vulnerability; no public exploit code or active exploitation has been confirmed.
Information Disclosure
Microsoft
-
CVE-2026-32217
MEDIUM
CVSS 5.5
Windows Kernel logs sensitive information that can be read by local authenticated users, allowing information disclosure on Windows 10 and Windows 11 systems across multiple versions as well as Windows Server 2012 through 2025. The vulnerability requires local access and valid user credentials (privilege level L) but results in high confidentiality impact. Microsoft has released patches for all affected versions.
Information Disclosure
Microsoft
-
CVE-2026-32216
MEDIUM
CVSS 5.5
Null pointer dereference in Windows Redirected Drive Buffering denies service to local authenticated users on Windows 11 version 26H1 (build 10.0.28000.0-10.0.28000.1835). An authorized attacker with local access can trigger the vulnerability to crash the affected system component, though code execution is not possible. Vendor-released patch available; no public exploit code identified at time of analysis.
Denial Of Service
Null Pointer Dereference
Microsoft
-
CVE-2026-32215
MEDIUM
CVSS 5.5
Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, and 2025. An authorized local attacker with user-level privileges can access kernel log files to retrieve confidential data without elevated rights or user interaction. Microsoft has released patches addressing this CWE-532 insertion-of-sensitive-information vulnerability with specific build fixes across all affected editions.
Information Disclosure
Microsoft
-
CVE-2026-32214
MEDIUM
CVSS 5.5
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Authentication Bypass
-
CVE-2026-32212
MEDIUM
CVSS 5.5
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim
Information Disclosure
-
CVE-2026-32196
MEDIUM
CVSS 6.1
Stored cross-site scripting (XSS) in Windows Admin Center before version 2.6.5.16 allows unauthenticated remote attackers to inject malicious scripts that execute in the browsers of other users, enabling account spoofing and data theft. The vulnerability requires user interaction (clicking a malicious link) but has network-wide scope, affecting all users of the Admin Center instance. Microsoft has released a patched version; exploitation is currently limited to scenarios where attackers can socially engineer clicks on crafted URLs.
XSS
Microsoft
-
CVE-2026-32181
MEDIUM
CVSS 5.5
Improper privilege management in Microsoft Windows allows authenticated local attackers to deny service by exploiting a privilege escalation flaw affecting Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2022 and 2025. The vulnerability requires local access and valid credentials but does not permit code execution or data manipulation. CVSS 5.5 reflects moderate severity; CISA SSVC framework rates exploitation as none with partial technical impact, indicating this is not currently a priority threat despite patch availability.
Privilege Escalation
Microsoft
-
CVE-2026-32176
MEDIUM
CVSS 6.7
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally via improper neutralization of SQL command elements. Affected versions include SQL Server 2016 SP3, 2017, 2019, 2022, and 2025 across multiple cumulative updates and GDR releases. The CVSS 6.7 score reflects the requirement for high-privilege authentication and local attack vector, but the high confidentiality, integrity, and availability impact makes this a material risk f
SQLi
-
CVE-2026-32167
MEDIUM
CVSS 6.7
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally through improper neutralization of special elements in SQL commands. Affected versions span SQL Server 2016 SP3 through 2025, with patch available from Microsoft. Attack requires local access and high-privilege credentials (PR:H in CVSS vector), limiting real-world impact to insider threats or compromised administrative accounts; CVSS 6.7 reflects high confidentiality, integrity, and availability impact but constrained by authentication and local-only attack vector.
SQLi
-
CVE-2026-32151
MEDIUM
CVSS 6.5
Windows Shell information disclosure vulnerability (CVE-2026-32151) allows authenticated network attackers to read sensitive data without authorization. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2012-2025, and associated Server Core installations. Microsoft has released vendor patches for all affected versions; exploitation requires valid credentials and network access but no user interaction.
Information Disclosure
Microsoft
-
CVE-2026-32088
MEDIUM
CVSS 6.1
Windows Biometric Service contains a race condition in concurrent resource access that allows unauthorized attackers to bypass biometric authentication controls via physical attack, affecting Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2019, 2022, and 2025. The vulnerability requires physical access to the device and carries a moderate CVSS score of 6.1 (physical attack vector); Microsoft has released patches for all affected versions.
Authentication Bypass
Race Condition
Microsoft
-
CVE-2026-32085
MEDIUM
CVSS 5.5
Windows Remote Procedure Call (RPC) discloses sensitive information to local authenticated users in Windows 10, Windows 11, and Windows Server 2016-2025. An authorized attacker with local access and limited privileges can read confidential data without user interaction, affecting multiple Windows editions across a 9-year product span. Patch availability confirmed from Microsoft; no active exploitation reported.
Information Disclosure
Microsoft
-
CVE-2026-32084
MEDIUM
CVSS 5.5
Windows File Explorer exposes sensitive information to authenticated local users with low privileges, allowing them to read confidential data without modification or service disruption. This affects multiple Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025. Microsoft has released patches addressing the information disclosure vector; exploitation requires local system access and valid user credentials.
Information Disclosure
Microsoft
-
CVE-2026-32081
MEDIUM
CVSS 5.5
Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local users to access sensitive information without authorization. The vulnerability affects multiple Windows 10 versions (1607, 1809, 21H2, 22H2), Windows 11 versions (22H3 through 26H1), and Windows Server 2016 through 2025. Microsoft has released patches addressing this CWE-200 information exposure flaw, with no evidence of active exploitation at the time of analysis.
Information Disclosure
Microsoft
-
CVE-2026-32079
MEDIUM
CVSS 5.5
Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local attackers to read sensitive files through a flaw in access control validation. CVSS 5.5 indicates moderate risk with confidentiality impact but no integrity or availability compromise. Patch available from Microsoft; no public exploit code or active exploitation confirmed at time of analysis.
Information Disclosure
Microsoft
-
CVE-2026-32072
MEDIUM
CVSS 6.2
Improper authentication in Windows Active Directory enables local spoofing attacks on unauthenticated users, allowing attackers with local access to bypass authentication mechanisms and gain unauthorized access to sensitive information. This vulnerability affects multiple Windows 10 and Windows 11 versions as well as Windows Server 2016 through 2025. A vendor-released patch is available from Microsoft, and the moderate CVSS score (6.2) reflects the local attack vector requirement combined with high confidentiality impact.
Authentication Bypass
Microsoft
-
CVE-2026-31924
MEDIUM
CVSS 5.3
Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent Cloud CLS, allowing network-based attackers to intercept and read confidential information without authentication. Vendor-released patch: version 3.16.0. EPSS indicates low real-world exploitation probability (0.01%), though the attack vector is unauthenticated and low-complexity, suggesting availability of automated interception tools rather than active targeted exploitation.
Apache
Information Disclosure
-
CVE-2026-30480
MEDIUM
CVSS 6.5
A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbitrary PHP files from the server filesystem via path traversal sequences in the nfsen parameter.
PHP
Path Traversal
LFI
-
CVE-2026-27931
MEDIUM
CVSS 5.5
Out-of-bounds read in Windows GDI (Graphics Device Interface) allows local attackers to disclose sensitive information without authentication. The vulnerability affects Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2022/2025, requiring user interaction to trigger. Microsoft has released patches for all affected versions, with specific build numbers provided for remediation.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-27930
MEDIUM
CVSS 5.5
Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-27925
MEDIUM
CVSS 6.5
Use-after-free memory corruption in Windows UPnP Device Host enables unauthenticated adjacent network attackers to disclose sensitive information with CVSS 6.5 high severity. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and multiple Windows Server editions (2012 through 2025). Microsoft has released patches with specific version thresholds; exploitation requires network adjacency but no authentication or user interaction.
Denial Of Service
Use After Free
Memory Corruption
Microsoft
-
CVE-2026-27906
MEDIUM
CVSS 4.4
Windows Hello biometric authentication can be bypassed by high-privileged local attackers through improper input validation, allowing unauthorized access to authentication mechanisms. This affects Windows 10 versions 21H2 and 22H2, and Windows 11 versions 22H3 through 26H1. The vulnerability requires administrative or SYSTEM-level privileges to exploit and does not enable remote exploitation, but represents a significant risk in multi-user or compromised-admin scenarios where biometric security is the primary defense mechanism.
Authentication Bypass
Microsoft
-
CVE-2026-27683
MEDIUM
CVSS 4.1
Reflected cross-site scripting (XSS) in SAP BusinessObjects Business Intelligence allows authenticated attackers to inject malicious JavaScript via crafted URLs that execute in victim browsers, potentially exposing restricted information. The vulnerability requires user interaction (clicking a malicious link) and affects only confidentiality with a CVSS score of 4.1 (low severity). No public exploit code or active exploitation has been identified.
XSS
SAP
-
CVE-2026-27679
MEDIUM
CVSS 6.5
SAP S/4HANA frontend OData Service (Manage Reference Structures) allows authenticated users to update and delete child entities without proper authorization checks, enabling privilege escalation and data integrity violations. The vulnerability requires valid user credentials but no special privileges, affecting systems running vulnerable S/4HANA versions. Attackers can exploit exposed OData endpoints to modify or remove reference structure data that should be protected from their access level.
Authentication Bypass
SAP
-
CVE-2026-27678
MEDIUM
CVSS 6.5
SAP S/4HANA backend OData Service for Manage Reference Structures allows authenticated remote attackers to modify and delete child entities without proper authorization checks, compromising data integrity across reference data structures. The vulnerability requires valid user credentials but no elevated privileges, affecting organizations running vulnerable S/4HANA versions. CVSS 6.5 with confirmed patch availability via SAP Security Patch Day.
Authentication Bypass
SAP
-
CVE-2026-27677
MEDIUM
CVSS 6.5
SAP S/4HANA OData Service for Manage Reference Equipment lacks authorization checks, allowing authenticated users to modify and delete child entities without proper access controls. The vulnerability affects S/4HANA instances with the vulnerable OData service and requires low-privilege network access, resulting in high integrity impact but no confidentiality or availability risk. No public exploit code or active exploitation has been confirmed.
Authentication Bypass
SAP
-
CVE-2026-27676
MEDIUM
CVSS 4.3
SAP S/4HANA OData Service for Manage Technical Object Structures allows authenticated users to update and delete child entities without proper authorization checks, enabling unauthorized data modification. The vulnerability affects S/4HANA deployments exposing the vulnerable OData service and requires valid user credentials but no elevated privileges. CVSS base score is 4.3 (low-to-medium severity) with confirmed patch availability from SAP Security Patch Day.
Authentication Bypass
SAP
-
CVE-2026-27674
MEDIUM
CVSS 6.1
Cross-site scripting via code injection in SAP NetWeaver Application Server Java Web Dynpro allows unauthenticated remote attackers to inject arbitrary client-side code through crafted input, compromising user sessions and application data integrity when victims interact with the affected functionality. CVSS 6.1 (medium) reflects the requirement for user interaction and limited scope, but exploitation is straightforward with no authentication needed and low attack complexity.
RCE
Java
SAP
Code Injection
-
CVE-2026-27673
MEDIUM
CVSS 4.9
SAP S/4HANA (Private Cloud and On-Premise) allows authenticated local network users to delete arbitrary operating system files due to missing authorization checks, degrading system integrity and availability. The vulnerability requires prior authentication and high complexity attack conditions (AC:H), resulting in a CVSS score of 4.9. No evidence of active exploitation or public proof-of-concept code has been identified, but the authorization bypass is confirmed across both deployment models.
Authentication Bypass
SAP
-
CVE-2026-27672
MEDIUM
CVSS 4.3
Material Master application fails to enforce authorization checks for authenticated users executing reports, allowing disclosure of sensitive information to any authenticated user regardless of intended access permissions. Affects SAP Material Master with CVSS 4.3 (low severity) and confirmed authentication requirement; no active exploitation reported. Remote attackers with valid credentials can access restricted report data without additional attack complexity.
Authentication Bypass
-
CVE-2026-27301
MEDIUM
CVSS 5.5
Heap-based buffer overflow in Adobe FrameMaker 2022.8 and earlier allows local attackers to disclose sensitive information from process memory without user privileges, requiring only that a victim open a malicious document. CVSS 5.5 reflects confidentiality impact with low attack complexity, though no active exploitation or public proof-of-concept has been confirmed at analysis time.
Buffer Overflow
Heap Overflow
Adobe
-
CVE-2026-27300
MEDIUM
CVSS 5.5
Adobe FrameMaker 2022.8 and earlier suffers from uninitialized pointer access that leaks sensitive memory contents to local attackers. The vulnerability requires user interaction-a victim must open a specially crafted file-but once triggered, it bypasses memory protections and exposes confidential data without requiring authentication or modifying files. CVSS 5.5 reflects moderate severity (local attack vector, high confidentiality impact) with no public exploit identified at time of analysis.
Information Disclosure
Memory Corruption
Adobe
-
CVE-2026-27299
MEDIUM
CVSS 6.3
Adobe FrameMaker 2022.8 and earlier allows arbitrary file system read through improper input validation when a user opens a malicious file, enabling attackers to access sensitive data on the victim's system. The vulnerability requires user interaction and is classified as information disclosure with a CVSS score of 6.3. No active exploitation or public exploit code has been identified at the time of analysis.
Information Disclosure
Adobe
-
CVE-2026-27288
MEDIUM
CVSS 5.4
Stored Cross-Site Scripting in Adobe Experience Manager versions FP11.7 and earlier allows authenticated attackers to inject malicious JavaScript into form fields, which executes in victims' browsers with limited impact (confidentiality and integrity). The vulnerability requires user interaction (victim must view the affected page) and authenticated access, resulting in a CVSS 5.4 (medium) score. No public exploit code or active exploitation has been identified at time of analysis.
XSS
Adobe
-
CVE-2026-27286
MEDIUM
CVSS 5.5
Heap-based buffer overflow in Adobe InDesign Desktop versions 21.2 and earlier allows local attackers to disclose sensitive information from memory without authentication, requiring only user interaction to open a malicious file. The vulnerability has a CVSS score of 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Buffer Overflow
Heap Overflow
-
CVE-2026-27285
MEDIUM
CVSS 5.5
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows local attackers to cause application denial-of-service by crafting malicious files that trigger memory corruption when opened. This vulnerability requires user interaction to exploit and does not enable code execution or data compromise, making it primarily a disruption vector rather than a critical attack surface despite its moderate CVSS score of 5.5.
Buffer Overflow
Heap Overflow
-
CVE-2026-27258
MEDIUM
CVSS 5.5
Out-of-bounds write in Adobe DNG SDK 1.7.1 2502 and earlier causes application denial-of-service through memory corruption when processing malicious DNG files. The vulnerability requires user interaction (opening a crafted file) and affects local attackers on systems where DNG SDK is deployed; no public exploit code or active exploitation has been confirmed at time of analysis.
Buffer Overflow
Memory Corruption
-
CVE-2026-27222
MEDIUM
CVSS 5.5
Divide by zero vulnerability in Adobe Bridge versions 15.1.4 and earlier allows local denial of service when a victim opens a malicious file, crashing or freezing the application. The vulnerability requires user interaction and local file access but carries a moderate CVSS score of 5.5 due to high availability impact; no public exploit code or active exploitation has been confirmed.
Denial Of Service
-
CVE-2026-26175
MEDIUM
CVSS 4.6
Windows Boot Manager contains an uninitialized resource vulnerability (CWE-908) that allows unauthorized attackers to bypass security features through physical access to affected systems. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025. While the CVSS score of 4.6 reflects the physical attack vector requirement and information disclosure impact, the authentication bypass nature comb
Authentication Bypass
Microsoft
-
CVE-2026-26169
MEDIUM
CVSS 6.1
Buffer over-read in Windows Kernel Memory allows authenticated local attackers to disclose sensitive kernel information with high confidence. CVE-2026-26169 affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016 through 2025. The vulnerability requires local access and low-level user privileges but does not enable privilege escalation or code execution. Microsoft has released vendor patches addressing the issue across all affected versions.
Buffer Overflow
Microsoft
-
CVE-2026-26155
MEDIUM
CVSS 6.5
Microsoft Local Security Authority Subsystem Service (LSASS) information disclosure vulnerability allows authenticated network attackers to read sensitive memory contents via a bounds check bypass in the LSASS process. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. No public exploit code or active exploitation has been reported; vendor-released patches are available across all affected versions.
Buffer Overflow
Information Disclosure
Microsoft
-
CVE-2026-25691
MEDIUM
CVSS 6.7
Path traversal vulnerability in Fortinet FortiSandbox allows privileged super-admin users with CLI access to delete arbitrary directories on the system via crafted HTTP requests. Affects FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all versions, FortiSandbox Cloud 5.0.4, and FortiSandbox PaaS 5.0.4. CVSS 6.7 reflects high integrity and availability impact but requires authenticated super-admin privileges; no public exploit code or active KEV designation identified at time of analysis.
Path Traversal
Fortinet
-
CVE-2026-25133
MEDIUM
CVSS 4.8
Stored XSS in October CMS versions before 3.7.14 and 4.1.10 allows authenticated users with media upload permissions to bypass SVG sanitization regex patterns and inject malicious JavaScript through crafted SVG files. When a superuser or other high-privileged user views or embeds the malicious SVG, the payload executes in their browser context, enabling privilege escalation. The vulnerability requires both authenticated backend access and user interaction (viewing/embedding the SVG), resulting in a CVSS 4.8 (Medium) rating; no public exploit code has been identified at time of analysis.
XSS
Privilege Escalation
-
CVE-2026-25125
MEDIUM
CVSS 4.9
October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated editors to disclose sensitive environment variables through PHP's parse_ini_string() interpolation syntax in page settings fields. An attacker with Editor access can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS configuration fields, causing the server to resolve and expose database passwords, AWS credentials, and application keys, potentially enabling database compromise or session forgery. The vulnerability is limited to installations with cms.safe_mode enabled; CVSS 4.9 reflects high confidentiality impact but requires elevated privileges (PR:H) to exploit.
PHP
Information Disclosure
-
CVE-2026-24907
MEDIUM
CVSS 5.1
Stored cross-site scripting (XSS) in October CMS versions prior to 3.7.14 and 4.1.10 allows authenticated users with Event Log viewing permissions to execute arbitrary JavaScript in other users' browsers via malicious HTML content in the mail preview iframe. The vulnerability stems from improper iframe sandboxing when rendering logged email messages, affecting confidentiality and integrity with a CVSS score of 5.1. No public exploit code has been identified at the time of analysis.
XSS
-
CVE-2026-24906
MEDIUM
CVSS 5.1
Stored Cross-Site Scripting (XSS) in October CMS versions prior to 3.7.14 and 4.1.10 allows authenticated backend users with editor settings permissions to inject malicious JavaScript into Markup Classes fields, which executes unsanitized in the Froala editor dropdown menus when any user-including superusers-opens a RichEditor. This enables privilege escalation when a superuser performs routine content editing tasks. CVSS 5.1 indicates moderate risk; exploitation requires authenticated backend access and user interaction (opening an editor), but the stored nature of the payload and privilege escalation potential elevate real-world concern. No public exploit code or active CISA KEV status reported.
XSS
Privilege Escalation
-
CVE-2026-24318
MEDIUM
CVSS 4.2
Insecure session management in SAP Business Objects Business Intelligence Platform allows unauthenticated attackers to obtain and reuse valid session tokens, enabling unauthorized access to victim sessions with moderate complexity. An attacker exploiting this vulnerability could access or modify information within the compromised session's scope, affecting confidentiality and integrity. The attack requires user interaction (UI:R) and high attack complexity (AC:H), limiting real-world exploitation but still warranting prioritized remediation for organizations running affected BI Platform versions.
Authentication Bypass
SAP
-
CVE-2026-24069
MEDIUM
CVSS 5.4
Kiuwan SAST fails to properly enforce SSO login authorization for locally disabled user accounts, permitting disabled users to maintain application access through single sign-on mechanisms. This affects Kiuwan Cloud and Kiuwan SAST on-premise (KOP) versions prior to 2.8.2509.4, enabling authenticated attackers with prior credentials to bypass account disablement controls. An attacker whose account has been disabled by administrators can re-authenticate via SSO and regain unauthorized access to the system.
Authentication Bypass
-
CVE-2026-24032
MEDIUM
CVSS 6.9
Authentication bypass in Siemens SINEC NMS versions prior to V4.0 SP3 with UMC allows unauthenticated remote attackers to gain unauthorized access due to insufficient user identity validation in the UMC component (CWE-347: Improper Verification of Cryptographic Signature). The vulnerability enables network-based attacks with low complexity requiring no user interaction (CVSS 7.3, AV:N/AC:L/PR:N/UI:N), granting partial access to confidentiality, integrity, and availability. ZDI tracking ID CAN-27564 suggests coordinated disclosure. No active exploitation (CISA KEV) or public exploit code confirmed at time of analysis, though JWT-related authentication bypasses are well-understood attack primitives.
Authentication Bypass
Jwt Attack
-
CVE-2026-23670
MEDIUM
CVSS 5.7
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows authorized local attackers to bypass security features, affecting Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016-2025. With a CVSS score of 5.7 and high privilege requirement (PR:H), the vulnerability requires administrative or high-privilege account access but presents significant confidentiality and integrity risk to isolated security domai
Authentication Bypass
Microsoft
-
CVE-2026-23653
MEDIUM
CVSS 5.7
Command injection in GitHub Copilot Chat Extension for Visual Studio Code allows authenticated attackers with user interaction to disclose sensitive information over a network. The vulnerability affects CoPilot Chat Extension versions before 0.37.3 and requires an authorized user to interact with a crafted prompt or input. Microsoft has released a patched version (0.37.3) to remediate this CWE-77 command injection flaw.
Command Injection
-
CVE-2026-22692
MEDIUM
CVSS 4.9
Sandbox bypass in October CMS versions prior to 3.7.13 and 4.0.0-4.1.4 allows authenticated users with template editing permissions to bypass the optional Twig safe mode (CMS_SAFE_MODE) protections via unrestricted collect() helper methods. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with the non-default CMS_SAFE_MODE feature enabled. Fixed in versions 3.7.13 and 4.1.5.
Authentication Bypass
-
CVE-2026-22576
MEDIUM
CVSS 4.3
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Information Disclosure
Fortinet
-
CVE-2026-22574
MEDIUM
CVSS 4.1
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Information Disclosure
Fortinet
-
CVE-2026-22573
MEDIUM
CVSS 6.5
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.3) contains a path traversal vulnerability in File Content Extraction actions that allows authenticated remote attackers to read arbitrary files outside the intended directory with high confidentiality impact. The vulnerability requires valid credentials and is exploitable over the network with no user interaction; CVSS 6.5 reflects medium-to-high severity for a cloud security platform handling sensitive workflows.
Path Traversal
Fortinet
-
CVE-2026-22155
MEDIUM
CVSS 6.5
Fortinet FortiSOAR transmits sensitive information in cleartext over the network, allowing authenticated remote attackers to disclose confidential data. The vulnerability affects both PaaS and on-premise deployments across versions 7.3 through 7.6.x, with CVSS 6.5 reflecting moderate confidentiality impact requiring low-privilege authentication. No public exploit code or active exploitation has been confirmed at time of analysis.
Information Disclosure
Fortinet
-
CVE-2026-22154
MEDIUM
CVSS 4.6
Stored cross-site scripting (XSS) in Fortinet FortiSOAR allows authenticated remote attackers to inject malicious scripts via crafted HTTP requests, affecting both PaaS and on-premise deployments across versions 7.3 through 7.6.3. The vulnerability requires user interaction to trigger the payload and results in limited confidentiality and integrity impact, with a CVSS score of 4.6 reflecting the authentication requirement and user-interaction dependency. No public exploit code or active exploitation has been confirmed at the time of analysis.
XSS
Fortinet
-
CVE-2026-21742
MEDIUM
CVSS 5.7
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.x) transmits sensitive authentication credentials in cleartext in API responses for Secure Message Exchange and RADIUS configurations, allowing authenticated attackers with network access to intercept and view passwords. The vulnerability requires user interaction (UI:R) and prior authentication (PR:L), affecting confidentiality of stored credentials in these integrations with a CVSS score of 5.7.
Information Disclosure
Fortinet
Microsoft
-
CVE-2026-21331
MEDIUM
CVSS 6.1
Reflected cross-site scripting (XSS) in Adobe Connect 2025.3, 12.10, and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL, potentially compromising user session data and performing actions on behalf of the victim. The vulnerability affects multiple versions across a wide product scope and requires user interaction (clicking a malicious link) to trigger. No public exploit code or active exploitation has been confirmed at the time of analysis.
XSS
Adobe
-
CVE-2026-20945
MEDIUM
CVSS 4.6
Stored cross-site scripting (XSS) in Microsoft SharePoint Server allows authenticated users to inject malicious scripts that execute in the browsers of other authorized users viewing affected web pages, enabling account spoofing and credential theft within enterprise collaboration environments. The vulnerability affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition across all versions prior to specific patch releases. CVSS score of 4.6 reflects low severity due to authentication requirement and user interaction needed, but real-world risk is elevated in multi-user SharePoint deployments where XSS can be weaponized for privilege escalation or lateral movement.
XSS
Microsoft
-
CVE-2026-20928
MEDIUM
CVSS 4.6
Windows Recovery Environment Agent improperly stores sensitive information without adequate removal, allowing physical attackers to extract confidential data and bypass security features. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2016-2025, and Server Core installations across multiple builds. Microsoft has released vendor patches to remediate the information disclosure.
Information Disclosure
Microsoft
-
CVE-2026-20806
MEDIUM
CVSS 5.5
Type confusion in Windows COM component allows authenticated local attackers to read sensitive information from memory. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025 across multiple installation types. An attacker with local user privileges can exploit improper type handling in COM to disclose confidential data without modifying or disrupting system availability. Microsoft has released patches addressing this information disclosure risk.
Information Disclosure
Memory Corruption
Microsoft
-
CVE-2026-5754
MEDIUM
CVSS 6.1
Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.
XSS
-
CVE-2026-5713
MEDIUM
CVSS 5.3
Memory corruption in Python's asyncio introspection and profiling.sampling modules (3.14-3.15) allows a local attacker with high privileges to read and write arbitrary memory in a connected privileged Python process via remote debugging. Exploitation requires persistent, repeated connections and high tolerance for crashes due to ASLR; no public exploit code has been identified. SSVC framework rates technical impact as total, but exploitation remains none-indicating low real-world priority despite severe capability impact.
Buffer Overflow
Python
Stack Overflow
Red Hat
Suse
-
CVE-2026-4914
MEDIUM
CVSS 5.4
Stored cross-site scripting (XSS) in Ivanti Neurons for ITSM (on-premise and cloud) before version 2025.4 allows authenticated remote attackers to inject malicious scripts that execute in other users' sessions, enabling limited information disclosure. User interaction is required to trigger the vulnerability. No public exploit code or active exploitation has been identified.
XSS
Ivanti
-
CVE-2026-4913
MEDIUM
CVSS 5.7
Ivanti Neurons for ITSM before version 2025.4 allows authenticated attackers to retain access to disabled accounts via an unprotected alternate authentication path, enabling persistent unauthorized information disclosure. The vulnerability affects both on-premise and cloud deployments and requires user interaction (UI:R), limiting but not eliminating real-world risk in multi-user environments where account disablement is a critical security control.
Information Disclosure
Ivanti
-
CVE-2026-4832
MEDIUM
CVSS 6.9
Schneider Electric Easergy MiCOM protective relays contain hard-coded SNMP credentials that allow unauthenticated remote attackers to access sensitive device information and system configurations. An attacker can directly query the SNMP port (UDP 161) without authentication to retrieve operational data, relay status, and device parameters. This vulnerability affects 12 product lines across multiple versions and is classified as an authentication bypass with a CVSS 6.9 (medium-to-high confidentiality impact).
Authentication Bypass
-
CVE-2026-4479
MEDIUM
CVSS 4.4
Stored Cross-Site Scripting in WholeSale Products Dynamic Pricing Management WooCommerce plugin allows authenticated administrators to inject arbitrary web scripts via admin settings that execute for all users on affected pages. The vulnerability affects all versions up to and including 1.2 on multi-site WordPress installations or single-site installations with unfiltered_html disabled. While the CVSS score of 4.4 is moderate, exploitation requires high-privilege administrator credentials and the attack is limited by high attack complexity; however, the persistent nature of stored XSS means injected payloads affect all subsequent site visitors.
WordPress
XSS
-
CVE-2026-4109
MEDIUM
CVSS 4.3
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
WordPress
Authentication Bypass
-
CVE-2026-4059
MEDIUM
CVSS 6.4
Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.
WordPress
XSS
-
CVE-2026-2582
MEDIUM
CVSS 6.5
Unauthenticated attackers can execute arbitrary WordPress shortcodes in the Germanized for WooCommerce plugin (all versions up to 3.20.5) via the 'account_holder' parameter, which bypasses shortcode validation in the do_shortcode() function. This enables remote code execution with medium severity (CVSS 6.5) affecting any WordPress site with the vulnerable plugin installed. No public exploit code or active exploitation has been confirmed at the time of analysis.
WordPress
RCE
Code Injection
-
CVE-2026-2405
MEDIUM
CVSS 5.3
Denial of service in Schneider Electric PowerChute Serial Shutdown versions 1.4 and prior allows authenticated Web Admin users to trigger uncontrolled resource consumption by flooding the system with POST requests to the /helpabout endpoint, causing excessive troubleshooting zip file creation and service degradation. Attack requires valid admin credentials and network access to the web interface; CVSS 5.3 reflects low availability impact with no confidentiality or integrity compromise.
Denial Of Service
-
CVE-2026-2404
MEDIUM
CVSS 6.9
Log injection via improper output encoding in Schneider Electric PowerChute™ Serial Shutdown allows unauthenticated remote attackers to forge or inject malicious log entries by sending crafted POST requests to the /j_security_check endpoint, potentially obscuring attack trails or triggering false alerts.
Code Injection
-
CVE-2026-2403
MEDIUM
CVSS 5.3
Improper validation of input quantity in Schneider Electric PowerChute Serial Shutdown versions 1.4 and prior allows authenticated Web Admin users to truncate event and data logs via crafted POST /logsettings requests, compromising log integrity and audit trail reliability. The vulnerability requires valid admin credentials and network access but poses direct impact to forensic and compliance capabilities. No public exploit code or active exploitation has been confirmed at time of analysis.
Information Disclosure
-
CVE-2026-2402
MEDIUM
CVSS 6.9
Schneider Electric PowerChute Serial Shutdown v1.4 and prior allows remote credential brute force attacks due to missing rate limiting on authentication endpoints, enabling attackers to enumerate valid credentials across multiple API endpoints with no authentication prerequisite. The vulnerability has a CVSS score of 6.9 with network-based attack vector and no user interaction required, though the impact is limited to information disclosure rather than full account takeover.
Information Disclosure
-
CVE-2026-2400
MEDIUM
CVSS 5.3
CRLF injection in Schneider Electric PowerChute™ Serial Shutdown versions 1.4 and prior allows authenticated Web Admin users to reset application user credentials by manipulating the POST /setPCBEDesc request payload, achieving limited availability impact with CVSS 5.3 and confirmed actively exploited status (CISA KEV).
Code Injection
-
CVE-2026-2399
MEDIUM
CVSS 6.9
PowerChute Serial Shutdown allows authenticated administrative users to overwrite critical system files via path traversal in the POST /REST/upssleep endpoint when maliciously crafting request payloads, potentially causing complete system compromise or denial of service. The vulnerability requires high-privilege Web Admin credentials and adjacent network access, but results in total integrity and availability impact across the affected system. No public exploit code has been identified at the time of analysis.
Path Traversal
-
CVE-2026-1607
MEDIUM
CVSS 6.4
Stored cross-site scripting in the Surbma | Booking.com Shortcode WordPress plugin (all versions up to 2.1) allows authenticated contributors and above to inject malicious scripts into pages via insufficient input sanitization on the `surbma-bookingcom` shortcode attributes, causing arbitrary JavaScript execution for all site visitors accessing the compromised page. The vulnerability has a CVSS score of 6.4 with network-based attack vector and low complexity, requiring only contributor-level privileges to exploit. No public exploit code or active exploitation has been independently confirmed at the time of analysis.
WordPress
XSS
-
CVE-2026-0512
MEDIUM
CVSS 6.1
Reflected Cross-Site Scripting (XSS) in SAP Supplier Relationship Management (SRM) SICF Handler allows unauthenticated remote attackers to craft malicious URLs that, when accessed by victims, execute arbitrary JavaScript within their browsers. Successful exploitation enables attackers to steal session credentials, modify procurement data, or perform actions on behalf of authenticated users, affecting confidentiality and integrity of SRM operations. The vulnerability carries a CVSS score of 6.1 with moderate real-world risk due to required user interaction and cross-origin constraints, though no public exploit code or active exploitation has been confirmed at the time of analysis.
XSS
SAP
-
CVE-2026-0390
MEDIUM
CVSS 6.7
Windows Boot Loader accepts untrusted inputs for security decisions, allowing authorized local attackers to bypass security features with high confidentiality, integrity, and availability impact. This authentication bypass vulnerability (CVSS 6.7) affects Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2016, 2019, and 2022. Microsoft has released patches addressing the root cause of reliance on untrusted security-critical inputs.
Authentication Bypass
Microsoft
-
CVE-2026-0209
MEDIUM
CVSS 6.9
FlashArray Purity applies snapshot retention policies with timing deviations from configured schedules, allowing authenticated administrators to inadvertently trigger premature or delayed data lifecycle actions. This affects FlashArray versions 5.0.0 through 6.10.0, impacting data retention integrity and compliance posture. The vulnerability requires high administrative privileges to exploit and results in integrity compromise of snapshot management operations.
Information Disclosure
-
CVE-2025-69993
MEDIUM
CVSS 6.1
Leaflet through version 1.9.4 allows stored or reflected cross-site scripting (XSS) via the bindPopup() method, which renders user-supplied HTML without sanitization. Network-based attackers can inject malicious JavaScript through event handler attributes in popup content, executing arbitrary code in victims' browser sessions when they interact with affected map popups. No public exploit code or active exploitation has been confirmed at this time, though the vulnerability carries a CVSS 6.1 base score reflecting moderate risk with network-accessible attack surface and user interaction requirement.
XSS
-
CVE-2025-69893
MEDIUM
CVSS 4.6
A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard guidelines, which induce non-constant time...
Information Disclosure
-
CVE-2025-68649
MEDIUM
CVSS 6.0
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.
Path Traversal
Fortinet
-
CVE-2025-65136
MEDIUM
CVSS 6.1
Reflected cross-site scripting (XSS) in manikandan580 School-management-system 1.0 allows unauthenticated remote attackers to inject malicious scripts via the pagedes POST parameter in /studentms/admin/contact-us.php, affecting users with browser cookies or session tokens. Publicly available exploit code exists, and the vulnerability impacts confidentiality and integrity with moderate scope. CVSS score of 6.1 reflects the requirement for user interaction to trigger the malicious payload.
PHP
XSS
-
CVE-2025-65134
MEDIUM
CVSS 6.1
Reflected cross-site scripting (XSS) in School Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email POST parameter in the contact-us.php admin interface. A victim must click a crafted link, enabling attackers to steal session cookies, perform administrative actions, or redirect users to malicious sites. Public proof-of-concept code exists; however, real-world exploitation probability remains low (EPSS 0.02%) due to reliance on user interaction and limited automaton.
PHP
XSS
N A
-
CVE-2025-65132
MEDIUM
CVSS 6.1
Stored or reflected cross-site scripting (XSS) in alandsilva26 hotel-management-php 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of authenticated administrators via a malicious room_id GET parameter in /public/admin/edit_room.php. Public exploit code exists (SSVC confirms poc status). The vulnerability requires user interaction (UI:R) to trigger, affecting confidentiality and integrity of admin sessions with partial technical impact.
PHP
XSS
-
CVE-2025-61886
MEDIUM
CVSS 5.4
Reflected cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 5.0.0 through 5.0.4 allows unauthenticated remote attackers to inject malicious scripts via crafted HTTP requests. Exploitation requires user interaction (clicking a malicious link), resulting in session hijacking, credential theft, or malware distribution to administrators accessing the FortiSandbox web interface. No public exploit code or active exploitation has been confirmed at time of analysis.
XSS
Fortinet
-
CVE-2025-61624
MEDIUM
CVSS 6.0
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
Path Traversal
Fortinet
-
CVE-2025-59809
MEDIUM
CVSS 4.3
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
Fortinet
SSRF
-
CVE-2025-53847
MEDIUM
CVSS 6.5
Fortinet FortiOS allows unauthenticated remote attackers to execute arbitrary code or commands on affected devices through specially crafted packets due to missing authentication controls on a critical function. This affects FortiOS versions 6.2.9 through 6.2.17, all 6.4.x versions, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. With a CVSS score of 6.5 and an adjacent network attack vector, this represents a significant risk to FortiGate appliances accessible from local network segments. No public exploit code or active exploitation has been confirmed at time of analysis.
Authentication Bypass
Fortinet
-
CVE-2025-40745
MEDIUM
CVSS 6.3
Improper TLS certificate validation in Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025/SE2026, and Tecnomatix Plant Simulation allows unauthenticated remote attackers to perform man-in-the-middle attacks against the Analytics Service endpoint. An attacker positioned on the network path can intercept and decrypt communications, potentially disclosing sensitive information. CVSS 3.7 reflects low-severity impact; no public exploit or active exploitation confirmed, but the low attack complexity and network vector indicate practical exploitability in targeted enterprise environments.
Information Disclosure
Siemens
-
CVE-2025-15565
MEDIUM
CVSS 5.3
Unauthenticated attackers can bypass authorization checks in the Nexi XPay plugin for WordPress (versions up to 8.3.0) to mark pending WooCommerce orders as paid or completed by exploiting a missing authorization check on the redirect function. This allows payment fraud by converting unpaid orders into completed transactions without authentication. No public exploit code or active exploitation has been reported at time of analysis.
WordPress
Authentication Bypass
-
CVE-2025-13822
MEDIUM
CVSS 5.3
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perform actions with the privileges of other users. The vulnerability stems from missing authentication middleware on certain endpoints, enabling attackers on the local network (AV:A) to impersonate legitimate users without requiring credentials. No public exploit code or active exploitation has been confirmed at this time.
Authentication Bypass
-
CVE-2026-40319
LOW
CVSS 1.0
Denial of service in giskard-checks RegexMatching check via unguarded regex pattern matching allows local attackers with write access to check definitions to trigger catastrophic backtracking in Python's re.search() function, causing process hangs and disrupting CI/CD pipelines or automated test execution.
Denial Of Service
Python
-
CVE-2026-39419
LOW
CVSS 3.1
MaxKB versions 2.7.1 and below allow authenticated users to spoof tool execution results by exploiting Python frame introspection to extract the wrapper's UUID from bytecode, then writing forged output directly to file descriptor 1 to bypass stdout redirection and terminate the wrapper process before legitimate output is generated, causing the service to trust the attacker-controlled response. This integrity bypass requires prior authentication and local/network access but enables attackers to manipulate AI tool results without detection. The vulnerability has been patched in version 2.8.0.
Authentication Bypass
Python
-
CVE-2026-37602
LOW
CVSS 2.7
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 at /scheduler/admin/user/manage_user.php allows high-privilege authenticated attackers to read sensitive data via crafted SQL queries. CVSS score of 2.7 reflects the requirement for high administrative privileges (PR:H), limiting real-world impact. SSVC framework confirms no known active exploitation, non-automatable attack, and partial technical impact (confidentiality only). This is a low-severity vulnerability constrained by authentication requirements despite the presence of a SQL injection flaw.
PHP
SQLi
-
CVE-2026-37601
LOW
CVSS 2.7
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege administrators to read sensitive data through the /scheduler/admin/appointments/manage_appointment.php endpoint. The vulnerability requires administrative credentials and does not enable data modification or denial of service, limiting real-world impact despite network-accessible exposure. CVSS score of 2.7 reflects the high authentication barrier and confidentiality-only impact; CISA SSVC framework rates exploitation as 'none' with no automatable attack path.
PHP
SQLi
-
CVE-2026-37600
LOW
CVSS 2.7
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege users to read sensitive database information via the /scheduler/admin/appointments/view_details.php endpoint. The vulnerability requires administrative credentials and network access but carries low real-world risk due to restrictive authentication requirements (PR:H), limited scope of impact (confidentiality only), and CVSS score of 2.7. No public exploit code or active exploitation has been identified.
PHP
SQLi
-
CVE-2026-37598
LOW
CVSS 2.7
SourceCodester Patient Appointment Scheduler System v1.0 suffers from SQL injection in the SystemSettings.php update_settings function, allowing authenticated high-privilege administrators to execute arbitrary SQL queries. While tagged as RCE, the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) and SSVC framework indicate limited confidentiality impact with no confirmed integrity or availability consequences; this is primarily a SQL injection vulnerability requiring administrative credentials with no public exploit code identified at time of analysis.
PHP
RCE
SQLi
-
CVE-2026-37597
LOW
CVSS 2.7
SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/attendance_list.php endpoint, enabling unauthorized data disclosure with low confidentiality impact. The vulnerability requires administrator-level access and carries minimal real-world risk due to high privilege requirements and low exploitability (SSVC exploitation status: none), though it represents a defense-in-depth failure in an administrative function.
PHP
SQLi
-
CVE-2026-37596
LOW
CVSS 2.7
SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to extract sensitive database information via the /wfh_attendance/admin/manage_department.php endpoint. The CVSS 2.7 score reflects low real-world risk due to the requirement for high-privilege administrative credentials and confidentiality-only impact; no public exploit code has been identified, and the vulnerability is not confirmed as actively exploited.
PHP
SQLi
-
CVE-2026-37595
LOW
CVSS 2.7
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/manage_employee.php file. The CVSS score of 2.7 reflects limited impact (confidentiality only, no integrity or availability loss) and high authentication barriers (administrator role required). No public exploit code or active exploitation has been confirmed.
PHP
SQLi
-
CVE-2026-37594
LOW
CVSS 2.7
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege remote attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/view_employee.php endpoint. CVSS 2.7 reflects high authentication barriers (PR:H requires admin access), no automatable exploitation per SSVC, and confidentiality impact only. No public exploit code or active exploitation confirmed at time of analysis.
PHP
SQLi
-
CVE-2026-37593
LOW
CVSS 2.7
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privileged authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/view_att.php endpoint, potentially disclosing sensitive employee attendance data. The vulnerability requires administrative credentials and carries low real-world risk despite SQL injection's severity class, as evidenced by CVSS 2.7 and SSVC designation of no exploitation likelihood with partial technical impact. No public exploit code or active exploitation has been identified.
PHP
SQLi
-
CVE-2026-37592
LOW
CVSS 2.7
SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privilege authenticated administrators to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_pricing.php endpoint, resulting in partial confidentiality impact. The CVSS score of 2.7 reflects the requirement for high administrative privileges and absence of integrity or availability impact, placing this as a low-risk vulnerability despite the SQL injection classification. No public exploit code or active exploitation has been identified.
PHP
SQLi
-
CVE-2026-37591
LOW
CVSS 2.7
SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privileged remote attackers to read sensitive data through the /storage/admin/tenants/view_details.php endpoint. With a CVSS score of 2.7 and requirement for high administrative privileges (PR:H), this vulnerability has minimal real-world impact despite the SQL injection class; however, it represents a privilege-abuse risk within already-compromised administrative contexts. No public exploit code or active exploitation has been confirmed.
PHP
SQLi
-
CVE-2026-37590
LOW
CVSS 2.7
SQL injection in SourceCodester Storage Unit Rental Management System v1.0 allows high-privileged authenticated attackers to read sensitive database contents via crafted input in /storage/admin/rents/manage_rent.php. The vulnerability requires administrator-level access and produces only limited information disclosure with no impact on data integrity or availability. EPSS and SSVC assessments indicate minimal real-world exploitation risk due to authentication barrier and non-automatable attack requirements.
PHP
SQLi
-
CVE-2026-37589
LOW
CVSS 2.7
SQL Injection in SourceCodester Storage Unit Rental Management System v1.0 allows authenticated administrative users to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_storage_unit.php endpoint. The vulnerability requires high-privilege access (PR:H) and returns only limited information (confidentiality impact only), resulting in a low CVSS score of 2.7. No public exploit code or active exploitation has been confirmed at the time of analysis.
PHP
SQLi
-
CVE-2026-34454
LOW
CVSS 3.5
OAuth2 Proxy versions 7.11.0 through 7.15.1 fail to clear the session cookie when rendering the sign-in page due to a regression, allowing authenticated users to remain logged in even after attempting to log out via the sign-in page. On shared workstations, a subsequent user could hijack the previous user's authenticated session without additional credentials. This affects only deployments using the sign-in page as part of logout flow; organizations with dedicated logout endpoints are unaffected. The vulnerability carries a low CVSS score of 3.5 (physical attack vector required) but poses meaningful risk in shared-access environments.
Information Disclosure
-
CVE-2026-33948
LOW
CVSS 2.9
Input validation bypass in jq command-line JSON processor allows attackers to craft JSON with embedded NUL bytes that jq incorrectly truncates, validating only a benign prefix while silently discarding malicious trailing data. Versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are affected; the vulnerability enables parser differential attacks where jq validates hostile input as safe JSON, but downstream consumers process the complete input including injected payloads. With low CVSS (2.9) and attack timing complexity, exploitation risk remains moderate in scenarios where jq serves as a validation gate for untrusted JSON forwarded to other processors.
Authentication Bypass
-
CVE-2026-27675
LOW
CVSS 2.0
SAP Landscape Transformation allows high-privileged remote attackers to inject arbitrary ABAP code and operating system commands through an RFC-exposed function module, resulting in limited integrity impact where attackers cannot control the scope or extent of modifications. The attack requires high privileges, high complexity, and user interaction, reflected in a CVSS 2.0 score; no public exploit code or active exploitation has been identified.
RCE
SAP
Code Injection
-
CVE-2026-27316
LOW
CVSS 2.7
Insufficiently protected credentials in Fortinet FortiSandbox 5.0.0-5.0.5, 4.4.x, and FortiSandbox PaaS 5.0.1-5.0.5 allow authenticated administrators to read LDAP server credentials via client-side inspection. This low-severity information disclosure requires high-privilege authentication and network access, exposing only credential confidentiality without enabling modification or denial of service.
Information Disclosure
Fortinet
-
CVE-2026-27308
LOW
CVSS 2.4
ColdFusion versions 2023.18, 2025.6, and earlier are vulnerable to uncontrolled resource consumption that allows high-privileged attackers to trigger application denial-of-service by exhausting system resources without user interaction. This is a low-severity issue (CVSS 2.4) affecting only authenticated administrators, with no public exploit code or active exploitation reported.
Denial Of Service
-
CVE-2026-27307
LOW
CVSS 2.4
ColdFusion versions 2023.18, 2025.6 and earlier are vulnerable to uncontrolled resource consumption that allows high-privileged attackers to trigger denial-of-service by exhausting system resources without user interaction. The CVSS score of 2.4 reflects low severity due to the high-privilege requirement (PR:H), though the attack vector is adjacent network access and does not require authentication once the attacker has elevated privileges.
Denial Of Service
-
CVE-2026-21741
LOW
CVSS 2.4
Open redirect vulnerability in Fortinet FortiNAC-F allows authenticated system administrators to redirect users to arbitrary websites through crafted CSV file uploads. Affects FortiNAC-F 7.6.0-7.6.5, all 7.4.x, and all 7.2.x versions. The attack requires high privilege level (system administrator role) and user interaction (UI:R), resulting in low real-world impact despite network-accessible attack vector. No public exploit code or active exploitation confirmed.
Fortinet
Open Redirect
-
CVE-2026-2401
LOW
CVSS 2.4
Schneider Electric PowerChute™ Serial Shutdown versions 1.4 and prior expose confidential information through log file insertion when a Web Admin user executes a malicious file supplied by an attacker. The vulnerability (CWE-532) results in low confidentiality impact with local access required and user interaction; no public exploit code or active exploitation has been identified, and the overall CVSS score of 2.4 reflects limited real-world risk despite information disclosure classification.
Information Disclosure