| CVE-2026-50251 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever. | medium | |
| CVE-2026-50517 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. | critical | |
| CVE-2026-25288 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | high | |
| CVE-2026-65815 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-68809 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-70311 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-64903 | Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-66806 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-62912 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. | medium | |
| CVE-2026-54113 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-49179 | Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-59128 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-59135 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-61366 | Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62754 | Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-65787 | Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-70344 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62698 | Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62728 | Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62733 | Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62734 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62778 | Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network. | high | |
| CVE-2026-62781 | Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-65774 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-65797 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. | medium | |
| CVE-2026-62804 | External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-19401 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service. | high | |
| CVE-2026-68786 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-68894 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69275 | Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69293 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69367 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-69398 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69616 | Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-69686 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-69729 | Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-69847 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | high | |
| CVE-2026-70019 | Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network. | medium | |
| CVE-2026-73006 | Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-78522 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | medium | |
| CVE-2026-78511 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-83952 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-83967 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-83986 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-70562 | Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69719 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | medium | |
| CVE-2026-69817 | Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69553 | Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69415 | Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network. | medium | |
| CVE-2026-69267 | Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally. | medium | |
