| CVE-2026-42129 | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information. | high | |
| CVE-2026-45480 | Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-50519 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-12246 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes. | high | |
| CVE-2026-21369 | Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification. | medium | |
| CVE-2026-21368 | Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks. | medium | |
| CVE-2026-3588 | A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request. | medium | |
| CVE-2026-33378 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server. | medium | |
| CVE-2026-28383 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service. | medium | |
| CVE-2026-47647 | Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-32176 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-26166 | Double free in Windows Shell allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-26179 | Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27908 | Use after free in Windows TDI Translation Driver (tdx.sys) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27915 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27924 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27927 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27931 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-32081 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-32087 | Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32093 | Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32154 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32159 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32165 | Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-26177 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-26178 | Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally. | high | |
| CVE-2026-26182 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27911 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27920 | Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27928 | Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network. | high | |
| CVE-2026-32069 | Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32078 | Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32164 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-33819 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. | critical | |
| CVE-2026-32207 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-41105 | Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-42891 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-32204 | External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-42830 | Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | medium | |
| CVE-2026-35429 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-40357 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-40420 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-24285 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25165 | Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25166 | Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally. | high | |
| CVE-2026-25179 | Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25189 | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-102225 | Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-105009 | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-108461 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | high | |
