| CVE-2026-50347 | Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50359 | Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50361 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50386 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50504 | Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-50491 | Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50411 | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-50412 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50387 | Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50417 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. | high | |
| CVE-2026-50383 | Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-50431 | Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability | medium | |
| CVE-2026-50450 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50398 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-50425 | Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50404 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50429 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-50444 | Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-50480 | Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50435 | Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50650 | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. | high | |
| CVE-2026-59117 | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-11769 | We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations: - expression: "!has(object.spec.jsonnetLib)" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny] ### Acknowledgement We would like to thank Artem Cherezov for responsibly disclosing the vulnerability. | medium | |
| CVE-2026-10601 | A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend. | medium | |
| CVE-2026-50521 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-9272 | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification. | high | |
| CVE-2026-54998 | Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-14586 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for DNS-over-QUIC support in Unbound, it is expected to use monotonic time. Unbound was using realtime instead, and in DoQ environments with high concurrency and under pressure, an assert in libngtcp2 for the quic timestamp would trigger and terminate the server.This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. | medium | |
| CVE-2026-9765 | Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account | high | |
| CVE-2026-34346 | Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-40422 | Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-45496 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | medium | |
| CVE-2026-40378 | Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-49168 | Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack. | medium | |
| CVE-2026-48572 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-49783 | Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | high | |
| CVE-2026-49162 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-49171 | Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-49180 | Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-49787 | Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-50298 | Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack. | medium | |
| CVE-2026-49803 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-49794 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. | medium | |
| CVE-2026-49804 | Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack. | medium | |
| CVE-2026-50294 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-49797 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50300 | Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-50381 | Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-54109 | Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | high | |
| CVE-2026-50303 | Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally. | medium | |
