CVE watch
Every disclosure pulled from the NVD feed, filterable by severity.
CVE-2026-100217 published: Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100216 published: Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100215 published: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
Details →CVE-2026-100214 published: Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
Details →CVE-2026-100212 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100211 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100210 published: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100209 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100207 published: Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Details →CVE-2026-100205 published: Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100203 published: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100202 published: Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100201 published: Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100200 published: Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100133 published: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the p...
Details →CVE-2026-108378 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc valu...
Details →CVE-2026-108377 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro ...
Details →CVE-2026-108376 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled refe...
Details →CVE-2026-108375 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string...
Details →CVE-2026-106176 published: A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests
Details →