| CVE-2026-24302 | Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-4407 | Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces. | low | |
| CVE-2026-26138 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-26139 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. | high | |
| CVE-2026-32169 | Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-21380 | Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory. | high | |
| CVE-2026-21382 | Memory Corruption when handling power management requests with improperly sized input/output buffers. | high | |
| CVE-2026-3342 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissions via an exposed management interface. This vulnerability affects Fireware OS 11.9 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1. | high | |
| CVE-2026-21524 | Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-24304 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-33118 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-32168 | Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32184 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-33095 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-32199 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-20930 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25184 | Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-23670 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally. | medium | |
| CVE-2026-26161 | Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-26175 | Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack. | medium | |
| CVE-2026-27906 | Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally. | medium | |
| CVE-2026-32071 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-32152 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32156 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-32215 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-32219 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-26184 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27910 | Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27914 | Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27922 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-27923 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32072 | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. | medium | |
| CVE-2026-32074 | Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-32084 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-32149 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. | high | |
| CVE-2026-33099 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-40947 | Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path. | low | |
| CVE-2026-30496 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration (74 endpoints) and writing/modifying settings including volume, mute, brightness, power, network protocols enable/disable (including TELNET), display modes, and other projector functions. Any device on the same network can control the projector without authentication. | critical | |
| CVE-2026-34327 | Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. | high | |
| CVE-2026-25258 | Memory corruption while processing IOCTL calls for escape operations. | high | |
| CVE-2026-7764 | An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap memory or cause a Denial of Service (kernel oops/panic) via a crafted 802.11ah beacon or probe response frame containing a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate the IE length against the expected structure size before its result is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), which read at fixed offsets into the IE data. Because the length check only requires the IE to be longer than 3 bytes, an attacker can supply an undersized IE, causing a heap out-of-bounds read of up to 9 bytes. No authentication, association, or user interaction is required. | medium | |
| CVE-2026-32210 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. | high | |
| CVE-2026-33102 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-45430 | The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks. | high | |
| CVE-2026-41107 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-40374 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network. | medium | |
| CVE-2026-40360 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | high | |
| CVE-2026-33112 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-40358 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-40365 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | high | |
