CVE watch

CVE-2026-100217 published: Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.

CVE-2026-100216 published: Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-100215 published: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

CVE-2026-100214 published: Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.

CVE-2026-100212 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100211 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100210 published: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100209 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100207 published: Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

CVE-2026-100205 published: Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

CVE-2026-100203 published: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

CVE-2026-100201 published: Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

CVE-2026-100200 published: Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

CVE-2026-108378 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc valu...

CVE-2026-108377 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro ...

CVE-2026-108376 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled refe...

CVE-2026-108375 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string...

CVE-2026-104085 published: odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can ...

CVE-2025-57739 published: An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated atta...

CVE-2025-46773 published: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Clou...