Výsledky hledání

zdroj: Microsoft Security× v celém archivu zrušit filtry

2906 karet z 2906 položek · strana 47 z 49 CZ · EN/orig

19. 5. 2026 3

CVE-2026-37458 Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Information published.

EPSS 0.00 CVE-2026-37458 FRRouting US

Microsoft Security · 19. 5. 10:39

CVE-2026-28808 ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Information published.

EPSS 0.01 CVE-2026-28808 US

Microsoft Security · 19. 5. 10:39

CVE-2025-3198 GNU Binutils objdump bucomm.c display_info memory leak

Information published.

EPSS 0.00 CVE-2025-3198 GNU Binutils US

Microsoft Security · 19. 5. 10:01

17. 5. 2026 3

CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

Information published.

EPSS 0.00 CVE-2026-8328 US

Microsoft Security · 17. 5. 10:01

CVE-2026-7246 Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

Information published.

EPSS 0.01 CVE-2026-7246 Pallets US

Microsoft Security · 17. 5. 10:01

CVE-2026-8368 LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

Information published.

EPSS 0.00 CVE-2026-8368 US

Microsoft Security · 17. 5. 10:01

16. 5. 2026 2

CVE-2026-6477 PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

Information published.

EPSS 0.00 CVE-2026-6477 PostgreSQL US

Microsoft Security · 16. 5. 10:04

CVE-2026-6473 PostgreSQL server undersizes allocations, via integer wraparound

Information published.

EPSS 0.01 CVE-2026-6473 PostgreSQL US

Microsoft Security · 16. 5. 10:04

15. 5. 2026 8

CVE-2026-45494 Microsoft Edge (Chromium-based) Spoofing Vulnerability

Acknowledgement added. This is an informational change only.

EPSS 0.00 CVE-2026-45494 Microsoft US

Microsoft Security · 15. 5. 16:00

CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

CWE added. Informational change only.

EPSS 0.01 CVE-2026-45495 Microsoft US

Microsoft Security · 15. 5. 16:00

CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

Information published.

EPSS 0.00 CVE-2026-43968 US

Microsoft Security · 15. 5. 10:02

CVE-2026-7790 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

Information published.

EPSS 0.00 CVE-2026-7790 cowlib US

Microsoft Security · 15. 5. 10:02

CVE-2026-5172 CVE-2026-5172

Information published.

EPSS 0.03 CVE-2026-5172 US

Microsoft Security · 15. 5. 10:01

CVE-2026-4893 CVE-2026-4893

Information published.

EPSS 0.02 CVE-2026-4893 US

Microsoft Security · 15. 5. 10:01

CVE-2026-4891 CVE-2026-4891

Information published.

EPSS 0.06 CVE-2026-4891 US

Microsoft Security · 15. 5. 10:01

[Màj] Vulnérabilité dans Microsoft Exchange Server (15 mai 2026)

[Mise à jour du 11 juin 2026] Le 9 juin 2026, Microsoft a publié des versions correctives. [Publication initiale] Le 14 mai 2026, Microsoft a publié un avis de sécurité concernant la vulnérabilité CVE-2026-42897 affectant Exchange Server. Elle permet à un attaquant non authentifié de provoquer...

KEV ✓ EPSS 0.71 CVE-2026-42897 Microsoft FR US 2 zdrojů

CERT-FR – alerty 15. 5. 02:00 · Microsoft Security 14. 5. 16:00

14. 5. 2026 6

CVE-2026-7168 cross-proxy Digest auth state leak

Information published.

EPSS 0.00 CVE-2026-7168 US

Microsoft Security · 14. 5. 10:03

CVE-2026-6253 proxy credentials leak over redirect-to proxy

Information published.

EPSS 0.01 CVE-2026-6253 US

Microsoft Security · 14. 5. 10:02

CVE-2026-5545 wrong reuse of HTTP Negotiate connection

Information published.

EPSS 0.00 CVE-2026-5545 US

Microsoft Security · 14. 5. 10:02

CVE-2026-6429 netrc credential leak with reused proxy connection

Information published.

EPSS 0.01 CVE-2026-6429 US

Microsoft Security · 14. 5. 10:02

CVE-2026-4873 connection reuse ignores TLS requirement

Information published.

EPSS 0.00 CVE-2026-4873 US

Microsoft Security · 14. 5. 10:02

CVE-2026-6276 stale custom cookie host causes cookie leak

Information published.

EPSS 0.00 CVE-2026-6276 US

Microsoft Security · 14. 5. 10:01

13. 5. 2026 1

CVE-2026-8177 XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences

Information published.

EPSS 0.01 CVE-2026-8177 XML::LibXML US

Microsoft Security · 13. 5. 10:05

12. 5. 2026 15

CVE-2026-40367 Microsoft Word Remote Code Execution Vulnerability

The security impact for this vulnerability has been revised from Critical to Important. In addition, the CVSS vector and FAQs were modified. This change does not affect the available security updates. Customers should continue to install the recommended updates to remain protected from this vulnerability.

EPSS 0.00 CVE-2026-40367 Microsoft US

Microsoft Security · 12. 5. 16:00

CVE-2026-34336 Windows DWM Core Library Elevation of Privilege Vulnerability

The security impact for this CVE has been revised based on a re-assessment of the vulnerability. The original classification of Information Disclosure (ID) has been updated to Elevation of Privilege (EoP).

EPSS 0.00 CVE-2026-34336 US

Microsoft Security · 12. 5. 16:00

CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability

The executive summary has been updated to include additional details about this vulnerability. This change does not affect the available security updates. Customers should install the recommended updates to remain protected from this vulnerability.

EPSS 0.00 CVE-2026-33117 US

Microsoft Security · 12. 5. 16:00

CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

EPSS 0.01 CVSS 9.9 CVE-2026-42898 Microsoft US

Microsoft Security · 12. 5. 16:00

CVE-2026-41088 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

EPSS 0.00 CVSS 7.8 CVE-2026-41088 US

Microsoft Security · 12. 5. 16:00

CVE-2026-42825 Windows Telephony Service Elevation of Privilege Vulnerability

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

EPSS 0.00 CVSS 7.0 CVE-2026-42825 US

Microsoft Security · 12. 5. 16:00

CVE-2026-40361 Microsoft Outlook and Word Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

EPSS 0.01 CVSS 8.4 CVE-2026-40361 Microsoft US

Microsoft Security · 12. 5. 16:00

CVE-2026-33841 Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

EPSS 0.00 CVSS 7.8 CVE-2026-33841 US

Microsoft Security · 12. 5. 16:00

CVE-2026-21530 Windows Rich Text Edit Elevation of Privilege Vulnerability

Added Office softwares to the Security Updates table. Customers that are running supported versions of Office are encouraged to update to the indicated versions to be protected from this vulnerability.

EPSS 0.00 CVE-2026-21530 US

Microsoft Security · 12. 5. 16:00

CVE-2026-41100 Microsoft 365 Copilot for Android Spoofing Vulnerability

Added Microsoft Excel for Android, Microsoft Word for Android, Microsoft Loop for Android, Microsoft PowerPoint for Android and Microsoft OneNote for Android softwares to the Security Updates table. Customers that are running supported version of these products are encouraged to update to the indicated versions to be protected from this vulnerability.

EPSS 0.00 CVE-2026-41100 Microsoft US

Microsoft Security · 12. 5. 16:00

CVE-2026-35433 .NET Elevation of Privilege Vulnerability

This CVE was updated to fix the download link for .NET Framework 3.8 & 4.81 for Windows 2025

EPSS 0.01 CVE-2026-35433 US

Microsoft Security · 12. 5. 16:00

CVE-2026-32177 .NET Elevation of Privilege Vulnerability

This CVE was updated to fix the download link for .NET Framework 3.8 & 4.81 for Windows 2025

EPSS 0.01 CVE-2026-32177 US

Microsoft Security · 12. 5. 16:00

CVE-2026-33840 Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

EPSS 0.02 CVSS 7.8 CVE-2026-33840 US

Microsoft Security · 12. 5. 16:00

CVE-2026-41086 Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

EPSS 0.00 CVSS 8.8 CVE-2026-41086 US

Microsoft Security · 12. 5. 16:00

CVE-2026-40417 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

EPSS 0.00 CVSS 7.8 CVE-2026-40417 Microsoft US

Microsoft Security · 12. 5. 16:00

11. 5. 2026 2

CVE-2026-35429 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

EPSS 0.00 CVSS 4.3 CVE-2026-35429 Microsoft US

Microsoft Security · 11. 5. 16:00

CVE-2026-45186 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Information published.

EPSS 0.00 CVE-2026-45186 libexpat US

Microsoft Security · 11. 5. 10:03

10. 5. 2026 1

CVE-2026-33814 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Information published.

EPSS 0.01 CVE-2026-33814 US

Microsoft Security · 10. 5. 10:02

7. 5. 2026 1

CVE-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API

Information published.

EPSS 0.00 CVE-2026-42151 US

Microsoft Security · 7. 5. 10:03

6. 5. 2026 1

CVE-2026-43964 Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

Information published.

EPSS 0.01 CVE-2026-43964 Postfix US

Microsoft Security · 6. 5. 10:01

5. 5. 2026 1

CVE-2026-37457 An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.

Information published.

EPSS 0.00 CVE-2026-37457 FRRouting US

Microsoft Security · 5. 5. 10:03

3. 5. 2026 1

CVE-2026-7598 libssh2 userauth.c userauth_password integer overflow

Information published.

EPSS 0.00 CVE-2026-7598 libssh2 US

Microsoft Security · 3. 5. 10:01

1. 5. 2026 4

CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Information published.

EPSS 0.01 CVE-2026-3087 US

Microsoft Security · 1. 5. 10:04

CVE-2026-40356 In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

Information published.

EPSS 0.01 CVE-2026-40356 MIT US

Microsoft Security · 1. 5. 10:03

CVE-2026-40355 In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Information published.

EPSS 0.01 CVE-2026-40355 MIT US

Microsoft Security · 1. 5. 10:03

CVE-2026-41526 In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.

Information published.

EPSS 0.00 CVE-2026-41526 KDE US

Microsoft Security · 1. 5. 10:03

30. 4. 2026 3

CVE-2026-41607 Apache Thrift: C++ JSON OOB read

Information published.

EPSS 0.01 CVE-2026-41607 Apache US

Microsoft Security · 30. 4. 10:11

CVE-2026-41606 Apache Thrift: c_glib dispatch stack overflow

Information published.

EPSS 0.01 CVE-2026-41606 Apache US

Microsoft Security · 30. 4. 10:11

CVE-2026-6357 pip self-update functionality can import newly installed modules after wheel installation

Information published.

EPSS 0.00 CVE-2026-6357 US

Microsoft Security · 30. 4. 10:10

29. 4. 2026 1

CVE-2026-40225 In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Information published.

EPSS 0.00 CVE-2026-40225 systemd US

Microsoft Security · 29. 4. 10:06

23. 4. 2026 1

CVE-2026-3219 pip doesn't reject concatenated ZIP and tar archives

Information published.

EPSS 0.00 CVE-2026-3219 pip US

Microsoft Security · 23. 4. 10:03

19. 4. 2026 1

CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Information published.

EPSS 0.01 CVE-2026-6100 US

Microsoft Security · 19. 4. 10:01

18. 4. 2026 1

CVE-2026-41080 libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Information published.

EPSS 0.00 CVE-2026-41080 libexpat US

Microsoft Security · 18. 4. 10:01

17. 4. 2026 1

CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Information published.

EPSS 0.00 CVE-2026-41035 rsync US

Microsoft Security · 17. 4. 10:02

15. 4. 2026 1

CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF

Information published.

EPSS 0.01 CVE-2026-1502 US

Microsoft Security · 15. 4. 10:04

14. 4. 2026 2

CVE-2026-26174 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

EPSS 0.00 CVSS 7.0 CVE-2026-26174 US

tg: zranitelnost

Microsoft Security · 14. 4. 16:00

CVE-2026-32202 Windows Shell Spoofing Vulnerability

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

KEV ✓ EPSS 0.64 CVSS 4.3 CVE-2026-32202 US

Microsoft Security · 14. 4. 16:00