CVE-2026-68835 Windows Print Spooler Components Elevation of Privilege Vulnerability
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-68835 US
Výsledky hledání
60
CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.
EPSS 0.00 CVE-2026-68833 US
CVE-2026-68832 Windows NTFS Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-68832 US
CVE-2026-68830 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability
Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-68830 US
CVE-2026-68824 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-68824 US
CVE-2026-68787 Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
EPSS 0.00 CVE-2026-68787 Microsoft US
CVE-2026-68785 Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-68785 Microsoft US
CVE-2026-68784 Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68784 Microsoft US
CVE-2026-68781 Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68781 Microsoft US
CVE-2026-67633 Microsoft SQL Server Denial of Service Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-67633 Microsoft US
CVE-2026-67631 Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67631 Microsoft US
CVE-2026-67630 Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67630 Microsoft US
CVE-2026-67629 Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67629 Microsoft US
CVE-2026-67373 Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67373 Microsoft US
CVE-2026-67370 Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-67370 Microsoft US
CVE-2026-67368 Microsoft SQL Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-67368 Microsoft US
CVE-2026-50349 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50349 US
CVE-2026-55007 Microsoft Exchange Server Remote Code Execution Vulnerability
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-55007 Microsoft US
CVE-2026-62801 Microsoft PowerShell Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-62801 Microsoft US
CVE-2026-57098 Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-57098 Microsoft US
CVE-2026-77482 Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-77482 Microsoft US
CVE-2026-85360 Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-85360 US
CVE-2026-83941 Entra ID Elevation of Privilege Vulnerability
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-83941 US
CVE-2026-69782 Windows DNS Server Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69782 US
CVE-2026-70091 Windows DNS Denial of Service Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-70091 US
CVE-2026-69522 .NET and Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69522 US
CVE-2026-69341 Windows Image Acquisition Elevation of Privilege Vulnerability
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69341 US
CVE-2026-62895 Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-62895 US
CVE-2026-66308 Skype for Business and Lync Denial of Service Vulnerability
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-66308 US
CVE-2026-66306 Skype for Business Information Disclosure Vulnerability
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-66306 US
CVE-2026-66302 Skype for Business Remote Code Execution Vulnerability
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-66302 US
CVE-2026-66304 Skype for Business Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-66304 US
CVE-2026-62744 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-62744 Microsoft US
CVE-2026-62694 Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-62694 US
CVE-2026-62706 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-62706 Microsoft US
NCSC-2026-0346 [1.01] [M/H] Kwetsbaarheden verholpen in Siemens producten
Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance. De kwetsbaarheden stellen een kwaadwillende in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: * Denial-of-Service (DoS) * Manipulatie van gegevens * Omzeilen van een beveiligingsmaatregel * (Remote) code execution (root/admin rechten) * (Remote) code execution (gebruikersrechten) * Toegang tot gevoelige gegevens * Verhogen van rechten…
Siemens NL
SPOJENO PŘES CVE Sanate vulnerabilità in TYPO3 CMS
Aggiornamenti di sicurezza TYPO3 sanano 2 vulnerabilità con gravità “alta” in TYPO3 CMS, sistema open source per la gestione di contenuti web. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malevolo autenticato di accedere a informazioni sensibili ed elevare i propri privilegi sui sistemi interessati.
EPSS 0.00 CVE-2026-77132 CVE-2026-85400 TYPO3 Typo3 IT FR
Vulnerabilità in prodotti Schneider Electric
Schneider Electric ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità nei propri prodotti, di cui 1 con gravità “critica” e 3 con gravità “alta”.
EPSS 0.01 CVE-2026-19233 CVE-2026-3869 CVE-2026-77120 CVE-2026-8044 Schneider Electric IT
Risolte vulnerabilità in prodotti Qualcomm Technologies Inc.
Aggiornamenti di sicurezza Qualcomm Technologies Inc. sanano 14 vulnerabilità con gravità “alta” che interessano componenti software impiegati nelle piattaforme e nei chipset del produttore, utilizzati in dispositivi mobili, sistemi di connettività wireless, piattaforme automotive e soluzioni di calcolo. Tali vulnerabilità, qualora sfruttate, potrebbero consentire di accedere a informazioni riservate, compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.00 CVE-2025-59607 CVE-2026-24073 CVE-2026-24074 CVE-2026-24075 CVE-2026-24081 CVE-2026-25275 CVE-2026-25278 CVE-2026-25280 CVE-2026-25281 CVE-2026-25282 CVE-2026-25283 CVE-2026-25284 CVE-2026-25290 CVE-2026-25294 Qualcomm IT
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-81963 Microsoft Windows Link Following Vulnerability CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-86218 N-able N-central Static Code Injection Vulnerability These types of vulnerabilities…
KEV ✓ EPSS 0.07 CVE-2026-75650 CVE-2026-81963 CVE-2026-85880 CVE-2026-86218 Adobe Magento Microsoft N-able veřejná správa US
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
Executive summary China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation…
US
CareCam Pro IP Cameras
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take full control of the device. The following versions of CareCam Pro IP Cameras are affected: ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26 (CVE-2026-85083) CVSS Vendor Equipment Vulnerabilities v3 6.8 CareCam CareCam Pro IP Cameras Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Commercial Facilities Countries…
EPSS 0.00 CVSS 6.8 CVE-2026-85083 CareCam US
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
OverviewWhile conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.CVE IDDescriptionCWECVSSv4CVE-2026-86206Semicolon/Forwarded access-control bypassCWE…
KEV ✓ EPSS 0.54 CVE-2026-18577 CVE-2026-86206 CVE-2026-86207 N-able US
Risolte vulnerabilità in Dell Secure Connect Gateway
Rilasciati aggiornamenti di sicurezza che sanano numerose vulnerabilità, di cui 3 con gravità "critica" e 34 con gravità "alta" in Dell Secure Connect Gateway, soluzione utilizzata per la gestione e il supporto remoto dei sistemi.
Dell IT
Risolte vulnerabilità in prodotti JetBrains
Aggiornamenti di sicurezza JetBrains sanano alcune vulnerabilità, di cui 2 con gravità “critica” e 7 con gravità “alta”, che interessano vari prodotti. Tali vulnerabilità potrebbero consentire a un utente malintenzionato di accedere a informazioni riservate, alterare dati, eludere i meccanismi di sicurezza ed eseguire codice arbitrario sui sistemi interessati.
EPSS 0.01 CVE-2026-86478 CVE-2026-86479 CVE-2026-86480 CVE-2026-86482 CVE-2026-86492 CVE-2026-86494 CVE-2026-86498 CVE-2026-86502 CVE-2026-86504 JetBrains IT
SPOJENO PŘES CVE MikroTik router flaws allow takeover without a password
CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version of RouterOS and its SSH remote-management service is accessible from the internet. Attackers are exploiting two…
KEV ✓ EPSS 0.01 CVSS 9.2 CVE-2026-67276 CVE-2026-86060 MikroTik US HR IT
NCSC-2026-0345 [1.00] [M/H] Kwetsbaarheden verholpen in MikroTik RouterOS
MikroTik heeft meerdere kwetsbaarheden verholpen in RouterOS. De eerste kwetsbaarheid betreft een fout in de SSH-authenticatiemechanisme waarbij de exponent van RSA-sleutels niet werd geverifieerd. Hierdoor kunnen aanvallers RSA-handtekeningen vervalsen en ongeautoriseerde SSH-toegang verkrijgen. De tweede kwetsbaarheid betreft een probleem met gebruikersnamen die beginnen met een verboden teken, waardoor de trusted policy mask kan worden gemanipuleerd en privilege escalation mogelijk is binnen…
MikroTik NL
Aggiornamenti per prodotti Siemens
Siemens ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità nei propri prodotti, di cui 2 con gravità “critica” e 8 con gravità “alta”.
EPSS 0.01 CVE-2026-34223 CVE-2026-50093 CVE-2026-62645 CVE-2026-62646 CVE-2026-62647 CVE-2026-62648 CVE-2026-62649 CVE-2026-62650 CVE-2026-67367 Siemens IT
NCSC-2026-0344 [1.00] [H/H] Kwetsbaarheid verholpen in Adobe Commerce en Magento
Adobe heeft een kwetsbaarheid verholpen in Adobe Commerce en Magento. De kwetsbaarheid bevindt zich in de template engine van Adobe Commerce, waarbij speciale elementen niet correct worden geneutraliseerd. Een aanvaller kan hierdoor op afstand willekeurige code uitvoeren zonder dat er gebruikersinteractie nodig is. Dit gebeurt door misbruik te maken van een gewijzigde scope om privileges te escaleren of de uitvoeringcontext aan te passen. Adobe geeft aan dat deze kwetsbaarheid reeds actief…
Adobe NL
ZTNA Portal Improper Certificate Validation
CVSSv3 Score: 7.3 An improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentless ZTNA portal may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the ZTNA portal and the backend destination website. Revised on 2026-09-08 00:00:00
CVSS 7.3 Fortinet US
Workflow session email approval process bypass
CVSSv3 Score: 4.7 An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. Revised on 2026-09-08 00:00:00
CVSS 4.7 Fortinet US
Uncontrolled Resource Consumption in SNMP
CVSSv3 Score: 5.9 A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daemon may allow a remote authenticated attacker with user permission to cause a denial of service via SNMP GETBULK requests. Revised on 2026-09-08 00:00:00
CVSS 5.9 Fortinet US
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
CVSSv3 Score: 8.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. Revised on 2026-09-08 00:00:00
CVSS 8.9 Fortinet US
Open Redirect on FortiSIEM
CVSSv3 Score: 2.8 An URL redirection to untrusted site ('open redirect') [CWE-601] vulnerability in FortiSIEM may allow an authenticated attacker to cause a redirection to any website via specially crafted HTTP requests Revised on 2026-09-08 00:00:00
CVSS 2.8 Fortinet US
Null Pointer Dereference in Log Report
CVSSv3 Score: 2.5 A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. Revised on 2026-09-08 00:00:00
CVSS 2.5 Fortinet US
JWT used for authentication in web GUI signed with static key
CVSSv3 Score: 9.6 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00
CVSS 9.6 Fortinet US
Improper Authentication of FortiPAM Server
CVSSv3 Score: 9.1 An improper authentication vulnerability [CWE-287] in the Fortinet Privileged Access Agent Chrome Extension may allow a remote unauthenticated attacker to proxy a user's browser traffic through attacker controlled servers if the user visits a malicious website. Revised on 2026-09-08 00:00:00
CVSS 9.1 Fortinet US
Cron Job Injection in Remote Backup
CVSSv3 Score: 6.7 An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-09-08 00:00:00
CVSS 6.7 Fortinet US
Broken Access control on Websocket streams
CVSSv3 Score: 4.9 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00
CVSS 4.9 Fortinet US
Arbitrary process termination from exposed minifilter communication port
CVSSv3 Score: 4.7 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may allow an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. Revised on 2026-09-08 00:00:00
CVSS 4.7 Fortinet US