CVE-2026-105591 Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-105591 Microsoft US
Výsledky hledání
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
· zachyceno
· zachyceno
CVE-2026-96183 Windows Health and Optimized Experiences Service Information Disclosure Vulnerability
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-96183 US
· zachyceno
CVE-2026-102867 Microsoft Office Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-102867 Microsoft US
· zachyceno
CVE-2026-102866 Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102866 Microsoft US
· zachyceno
CVE-2026-102865 Microsoft Office SharePoint Information Disclosure Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-102865 Microsoft US
· zachyceno
CVE-2026-102864 Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-102864 Microsoft US
· zachyceno
CVE-2026-102863 Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102863 Microsoft US
· zachyceno
CVE-2026-102862 Microsoft Office SharePoint Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102862 Microsoft US
· zachyceno
CVE-2026-102861 Microsoft Office SharePoint Elevation of Privilege Vulnerability
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102861 Microsoft US
· zachyceno
CVE-2026-102860 Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102860 Microsoft US
· zachyceno
CVE-2026-102859 Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-102859 Microsoft US
· zachyceno
CVE-2026-102858 Microsoft Office OneNote Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102858 Microsoft US
· zachyceno
CVE-2026-102857 Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102857 Microsoft US
· zachyceno
CVE-2026-102856 Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102856 Microsoft US
· zachyceno
CVE-2026-102855 Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102855 Microsoft US
· zachyceno
CVE-2026-96956 SQL Server Elevation of Privilege Vulnerability
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-96956 US
· zachyceno
CVE-2026-70098 Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-70098 US
· zachyceno
CVE-2026-102238 Visual Studio Code Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102238 US
· zachyceno
CVE-2026-102235 Visual Studio Code Remote Code Execution Vulnerability
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102235 US
· zachyceno
CVE-2026-102234 Visual Studio Code Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-102234 US
· zachyceno
CVE-2026-102233 Visual Studio Code Security Feature Bypass Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-102233 US
· zachyceno
CVE-2026-102232 Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-102232 US
· zachyceno
CVE-2026-102231 Visual Studio Code Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-102231 US
· zachyceno
CVE-2026-102229 Visual Studio Code Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-102229 US
· zachyceno
CVE-2026-102227 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
EPSS < 0.01 CVE-2026-102227 US
· zachyceno
CVE-2026-108468 Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-108468 US
· zachyceno
CVE-2026-108457 Microsoft Windows PDF Remote Code Execution Vulnerability
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-108457 Microsoft US
· zachyceno
CVE-2026-108400 HEVC Video Extensions Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-108400 Microsoft US
· zachyceno
CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-105728 US
· zachyceno
CVE-2026-105727 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-105727 Microsoft US
· zachyceno
CVE-2026-105725 Windows Security App Elevation of Privilege Vulnerability
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-105725 US
· zachyceno
ADV260001 ADV260001 Hardening changes for ReFS volumes on removable media
Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the [Resilient File System (ReFS)](https://learn.microsoft.com/windows-server/storage/refs/refs-overview). This change is not enable by default until 2027. Please see [Hardening changes for ReFS volumes on removable media](https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/10/hardening-changes-for-refs-volumes-on-removable-media) for more information.
Microsoft US
· zachyceno
CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-103572 US
· zachyceno
CVE-2026-102850 Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102850 Microsoft US
· zachyceno
CVE-2026-102849 Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102849 Microsoft US
SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...]
CVE-2026-44756 * CVE-2026-58231 * CVE-2026-89108 * CVE-2026-89110 * CVE-2026-89111 * SAP US
JetBrains security advisory (AV26-1032)
Serial number: AV26-1032 Date: October 13, 2026 As of October 9, 2026, JetBrains is affected by a vulnerability in the following product: Exposed Prior to 1.5.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. JetBrains Fixed security issues
JetBrains CA
Progress security advisory (AV26-1031)
Serial number: AV26-1031 Date: October 13, 2026 As of October 12, 2026, Progress is affected by vulnerabilities in the following product: MarkLogic Server Prior to 11.3.7 Prior to 12.1.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Progress Customer Community Progress Trust Center
Progress CA
SAP security advisory – October 2026 monthly rollup (AV26-1030)
Serial number: AV26-1030 Date: October 13, 2026 As of October 13, 2026, SAP_SE is affected by vulnerabilities in the following products: SAP Cloud SDK Prior to 0.45.2 SAP Commerce Cloud (OOTB Code) Version COM_CLOUD 2211-JDK21 SAP Manufacturing Integration and Intelligence (Configuration Service) Version 15.5 Version XMII 15.4 SAP NetWeaver Visual Composer Version VC70RUNTIME 7.50 SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) Versions HDB 2.00, KRNL64UC 7.53, WEBDISP 7…
SAP CA
MikroTik security advisory (AV26-1029)
Serial number: AV26-1029 Date: October 13, 2026 As of October 12, 2026, MikroTik is affected by a vulnerability in the following product: RouterOS Prior to 7.24.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. MikroTik Downloads MikroTik Community Forum
MikroTik CA
Progress Software: sanate vulnerabilità in MarkLogic Server
Rilasciati aggiornamenti di sicurezza per sanare 31 vulnerabilità, di cui 5 con gravità "critica" e 24 con gravità "alta", in Progress MarkLogic Server, nota piattaforma di database NoSQL progettata per archiviare, integrare, gestire e ricercare grandi volumi di dati eterogenei all'interno di un unico sistema.
EPSS 0.01 a dalších 12 CVE-2026-85959 CVE-2026-85960 CVE-2026-85961 CVE-2026-85962 CVE-2026-85963 CVE-2026-85964 CVE-2026-85965 CVE-2026-85966 CVE-2026-85968 CVE-2026-85969 CVE-2026-85970 CVE-2026-85971 CVE-2026-85972 CVE-2026-85973 CVE-2026-85974 CVE-2026-85975 CVE-2026-9191 Progress Software IT
Risolte vulnerabilità in Craft CMS
Aggiornamenti di sicurezza sanano alcune vulnerabilità, di cui 2 con gravità “alta”, in Craft CMS, piattaforma open source per lo sviluppo e l’amministrazione di siti web e applicazioni digitali. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di sicurezza e di eseguire codice arbitrario sui sistemi interessati.
EPSS < 0.01 CVE-2026-109305 CVE-2026-109308 Craft CMS IT
Risolte vulnerabilità nella libreria Neo4j GraphQL
Risolte due vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", presenti nella libreria Neo4j GraphQL. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eludere dei meccanismi di sicurezza, accedere ad informazioni sensibili e manipolare i dati presenti sui sistemi interessati.
EPSS < 0.01 CVE-2026-92681 CVE-2026-92682 Neo4j IT
GitLab security advisory (AV26-1028)
Serial number: AV26-1028 Date: October 13, 2026 As of October 12, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.2.8 Prior to 19.3.5 Prior to 19.4.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 GitLab release notes | GitLab Docs
GitLab CA
Dell security advisory (AV26-1027)
Serial number: AV26-1027 Date: October 13, 2026 As of October 6, 2026, Dell is affected by vulnerabilities in the following products: Command | Configure (DCC) Prior to 5.2.3.35 Dell Container Storage Modules (CSM) Prior to 1.18.0 Dell OpenManage Integration with Microsoft Windows Admin Center (OMIMSWAC) Prior to 3.7.0 Dell Policy Manager for Secure Connect Gateway - Appliance Prior to 5.36.00.16 Dell System Update (DSU) Prior to 2.3.0.0 The Cyber Centre encourages users and administrators to…
Dell CA
Bender Customer&Partner Platform Vulnerability - Privilege Escalation
[VDE-2026-109] Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform. The issue allows any account to view the roles of other users. Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.
EPSS < 0.01 CVE-2026-94410 Bender DE
· zachyceno
Swann Communications SWIFI-SE2KIC
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) CVSS Vendor Equipment v3 6.2 Swann Communications SWIFI-SE2KIC firmware 1 Vulnerability Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Commercial Facilities…
EPSS < 0.01 CVE-2026-107605 CVE-2026-107606 CVE-2026-107607 Swann Communications US
Aggiornamenti per prodotti Siemens
Siemens ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità nei propri prodotti, di cui 4 con gravità “critica” e 14 con gravità “alta”.
EPSS < 0.01 a dalších 1 CVE-2026-102074 CVE-2026-102075 CVE-2026-102076 CVE-2026-44415 CVE-2026-59241 CVE-2026-63350 CVE-2026-63353 CVE-2026-63354 CVE-2026-72895 CVE-2026-78556 CVE-2026-78557 CVE-2026-85114 CVE-2026-89196 CVE-2026-89197 CVE-2026-89198 CVE-2026-89199 CVE-2026-89201 Siemens IT
Vulnerability in Payload CMS software
SQL Injection vulnerability (CVE-2026-63316) has been found in Payload CMS software.
EPSS < 0.01 CVE-2026-63316 Payload CMS PL
Vulnerabilità in prodotti Schneider Electric
Rilevate due nuove vulnerabilità con gravità “alta” in alcuni prodotti Schneider Electric.
EPSS < 0.01 CVE-2026-102250 CVE-2026-96434 Schneider Electric IT
GitLab rättar kritisk sårbarhet
GitLab har publicerat säkerhetsuppdateringar för flera sårbarheter i GitLab Community Edition (CE) och Enterprise Edition (EE). [1]
GitLab SE
NCSC-2026-0415 [1.00] [M/H] Kwetsbaarheden verholpen in Siemens-producten
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS. De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie van gegevens - Omzeilen van een beveiligingsmaatregel - (Remote) code execution (root/admin rechten) - Toegang tot systeemgegevens - Toegang tot gevoelige gegevens - Verhogen van rechten De…
Siemens NL
SAP Security Patch Day
Nell’ambito del Security Patch Day di ottobre, SAP rilascia aggiornamenti di sicurezza per risolvere molteplici nuove vulnerabilità, di cui 4 con gravità "critica" e 3 con gravità "alta".
EPSS < 0.01 CVE-2026-58249 CVE-2026-89107 CVE-2026-89108 CVE-2026-89110 CVE-2026-89111 CVE-2026-89113 CVE-2026-89120 SAP IT
AnyDesk: disponibile PoC pubblico per la CVE-2026-109390
Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-109390 - già sanata dal vendor - presente in AnyDesk per sistemi Linux, nota soluzione per l’accesso, il supporto e il controllo remoto dei dispositivi tramite connessioni di rete. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un attaccante remoto non autenticato di eseguire codice arbitrario con privilegi elevati sui sistemi interessati.
EPSS 0.02 CVE-2026-109390 AnyDesk IT
Cross-Site Scripting en la aplicación web de YouMind
Cross-Site Scripting in the YouMind web application Tue, 10/13/2026 - 09:48 Aviso Affected Resources YouMind web application. Description INCIBE has coordinated the publication of a medium severity vulnerability affecting the YouMind web application, an AI-powered creative workspace and study environment. The vulnerability was discovered by Miguel Jiménez Cámara. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type: CVE-2026-96535…
EPSS < 0.01 CVSS 5.1 CVE-2026-96535 YouMind ES
· zachyceno
arbitrary command execution in fgfmsd daemon
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised on 2026-10-13 00:00:00
CVSS 5.3 Fortinet US
· zachyceno
SQL command injection in webmail
CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSS 7.7 Fortinet US
· zachyceno
Persistent Denial of Service in Admin Profile
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSS 4.8 Fortinet US
· zachyceno
Multiple Arbitrary File Read/Write via SQL Injection
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00
CVSS 7.9 Fortinet US
· zachyceno
Improper access control and session management in the web management interface
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSS 9.6 Fortinet US