Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-49851

A flaw was found in Mistune, a Python Markdown parser. A remote attacker can exploit this vulnerability by providing a specially crafted Markdown input containing many consecutive bracket characters. This can lead to excessive CPU usage, causing a denial-of-service (DoS) condition on the affected system.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, lepture
Product
Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Migration Toolkit for Applications 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), mistune
Provider severity
HIGH
Conflicts
3

CVE-2026-4985

A vulnerability was identified in dloebl CGIF up to 0.5.2. This vulnerability affects the function cgif_addframe of the file src/cgif.c of the component GIF Image Handler. The manipulation of the argument width/height leads to integer overflow. The attack may be initiated remotely. The identifier of the patch is b0ba830093f4317a5d1f345715d2fa3cd2dab474. It is suggested to install a patch to address this issue.

PUBLISHED
Vendor
dloebl
Product
CGIF
Provider severity
MEDIUM
Conflicts
2

CVE-2026-49848

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's check_auth userauth branch wrote request-supplied userVariables into the connection state before comparing the supplied password. The writes are append-only and the connection is not closed on a failed compare, so values declared on bad-password attempts persisted on the same Web

PUBLISHED
Vendor
signalwire
Product
freeswitch
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49847

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process via stack overflow, terminating all calls and sessions on the host. The recursion drives the worker thread's stack pointer into the stack guard page, raising SIGSEGV from the kern

PUBLISHED
Vendor
signalwire
Product
freeswitch
Provider severity
HIGH
Conflicts
0

CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Log4j API
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49843

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied sessid on the first frame, before the authentication gate. Binding inserts the connection into the global session hash and, on a key collision, drops the prior occupant of that slot — sending it a verto.punt, detaching

PUBLISHED
Vendor
signalwire
Product
freeswitch
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49842

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The

PUBLISHED
Vendor
signalwire
Product
freeswitch
Provider severity
HIGH
Conflicts
0

CVE-2026-49841

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bounded by Content-Length rather than the buffer size, producing an attacker-controlled heap overflow

PUBLISHED
Vendor
signalwire
Product
freeswitch
Provider severity
CRITICAL
Conflicts
1

CVE-2026-49840

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl,

PUBLISHED
Vendor
signalwire
Product
freeswitch
Provider severity
CRITICAL
Conflicts
1

CVE-2026-4984

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of

PUBLISHED
Vendor
botpress
Product
botpress
Provider severity
HIGH
Conflicts
1

CVE-2026-49839

jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop it

PUBLISHED
Vendor
jqlang
Product
jq
Provider severity
HIGH
Conflicts
0

CVE-2026-49835

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This is

PUBLISHED
Vendor
sigstore
Product
timestamp-authority
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49834

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

PUBLISHED
Vendor
sigstore
Product
sigstore-go
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4983

Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This allows an attacker to publish an extension with a malicious SVG icon and achieve stored cross-site scripting (XSS) when a user navigates directly to the icon URL. On deployments using local storage, script execution occurs within the Open VSX application or

PUBLISHED
Vendor
Eclipse Foundation
Product
Eclipse Open VSX
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49824

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function's own namespace but performed no equivalent check on spec.environment.namespace. This issue has been patched in version 1.24.0.

PUBLISHED
Vendor
fission
Product
fission
Provider severity
HIGH
Conflicts
1

CVE-2026-49823

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.

PUBLISHED
Vendor
fission
Product
fission
Provider severity
HIGH
Conflicts
1

CVE-2026-49822

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.

PUBLISHED
Vendor
fission
Product
fission
Provider severity
HIGH
Conflicts
1

CVE-2026-49821

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace. This issue has been patched in version 1.24.0.

PUBLISHED
Vendor
fission
Product
fission
Provider severity
HIGH
Conflicts
1

CVE-2026-4982

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.

PUBLISHED
Vendor
pretix
Product
Venueless
Provider severity
HIGH
Conflicts
0

CVE-2026-49818

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-sam

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Airflow Samba provider
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49815

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to execution of arbitrary OS commands.

PUBLISHED
Vendor
Dell
Product
PowerProtect Data Domain
Provider severity
HIGH
Conflicts
0

CVE-2026-49814

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

PUBLISHED
Vendor
Dell
Product
PowerProtect Data Domain
Provider severity
HIGH
Conflicts
0

CVE-2026-49813

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution.

PUBLISHED
Vendor
Dell
Product
PowerProtect Data Domain
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49808

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 24H2, Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows 11 version 26H1
Provider severity
HIGH
Conflicts
2

CVE-2026-49807

Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019, Windows 11 version 26H1, Windows 10 Version 22H2, Windows Server 2025, Windows Server 2019 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2022, Windows 10 Version 21H2
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49806

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 25H2, Windows 11 version 26H1, Windows 11 Version 24H2, Windows Server 2025, Windows Server 2025 (Server Core installation)
Provider severity
HIGH
Conflicts
2

CVE-2026-49805

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 21H2, Windows Server 2012 R2, Windows Server 2012 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2019, Windows 10 Version 1607, Windows Server 2016, Windows Server 2012, Windows Server 2022, Windows 10 Version 22H2, Windows Server 2025, Windows 10 Version 1809, Windows 11 Version 24H2, Windows 11 version 26H1, Windows 11 Version 25H2, Windows Server 2019 (Server Core installation), Windows Server 2012 R2 (Server Core installation), Windows Server 2025 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-49804

Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 25H2, Windows Server 2019 (Server Core installation), Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 R2, Windows Server 2012, Windows Server 2025 (Server Core installation), Windows Server 2022, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows 11 Version 24H2, Windows Server 2016, Windows Server 2025, Windows Server 2012 (Server Core installation), Windows 10 Version 1607, Windows 10 Version 1809
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49803

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2025 (Server Core installation), Windows 10 Version 1809, Windows Server 2012 R2, Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows Server 2019, Windows Server 2016 (Server Core installation), Windows Server 2012 R2 (Server Core installation), Windows 11 Version 24H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows 11 version 26H1, Windows 11 Version 25H2, Windows Server 2016, Windows 10 Version 1607, Windows Server 2025
Provider severity
HIGH
Conflicts
1

CVE-2026-49802

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 25H2, Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows 11 Version 24H2
Provider severity
HIGH
Conflicts
2

CVE-2026-49801

Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 version 26H1, Windows Server 2022, Windows Server 2012 R2 (Server Core installation), Windows 10 Version 21H2, Windows Server 2012 (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation), Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows 11 Version 24H2, Windows 10 Version 1607, Windows Server 2016, Windows Server 2012 R2, Windows 11 Version 25H2, Windows Server 2012, Windows Server 2016 (Server Core installation), Windows 10 Version 22H2, Windows Server 2019
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49800

Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1809, Windows Server 2025, Windows 10 Version 21H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2022, Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows Server 2025 (Server Core installation), Windows Server 2019, Windows 11 Version 24H2
Provider severity
HIGH
Conflicts
2

CVE-2026-4980

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.

PUBLISHED
Vendor
Inkscape
Product
Inkscape
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49799

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012 R2 (Server Core installation), Windows 10 Version 22H2, Windows Server 2022, Windows Server 2016 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows Server 2012 (Server Core installation), Windows 11 version 26H1, Windows Server 2019 (Server Core installation), Windows Server 2012, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows Server 2019, Windows Server 2012 R2, Windows Server 2016, Windows 10 Version 1607, Windows 11 Version 25H2, Windows 10 Version 1809
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49798

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1809, Windows Server 2012 R2, Windows 11 Version 24H2, Windows 10 Version 1607, Windows Server 2025, Windows Server 2012 (Server Core installation), Windows Server 2016, Windows Server 2012 R2 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 26H1, Windows 10 Version 21H2, Windows Server 2019 (Server Core installation), Windows Server 2012, Windows Server 2019, Windows Server 2016 (Server Core installation), Windows 10 Version 22H2, Windows Server 2022
Provider severity
CRITICAL
Conflicts
1

CVE-2026-49797

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012 (Server Core installation), Windows 10 Version 22H2, Windows 10 Version 1809, Windows Server 2022, Windows 10 Version 21H2, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows Server 2012 R2, Windows 11 Version 25H2, Windows Server 2025, Windows Server 2012 R2 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2012, Windows 11 version 26H1, Windows 10 Version 1607, Windows Server 2016, Windows Server 2019, Windows Server 2019 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-49796

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2022, Windows Server 2025, Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows 10 Version 1607, Windows Server 2012 (Server Core installation), Windows 10 Version 22H2, Windows 11 Version 25H2, Windows Server 2019, Windows Server 2012 R2 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows 10 Version 21H2, Windows 11 version 26H1
Provider severity
HIGH
Conflicts
1

CVE-2026-49795

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1809, Windows 11 version 26H1, Windows 10 Version 22H2, Windows Server 2019, Windows 10 Version 21H2, Windows Server 2022, Windows 11 Version 25H2, Windows Server 2025, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows Server 2019 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-49794

Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012 R2 (Server Core installation), Windows Server 2016 (Server Core installation), Windows 10 Version 1607, Windows Server 2012, Windows 11 version 26H1, Windows Server 2012 (Server Core installation), Windows 10 Version 22H2, Windows Server 2019, Windows 11 Version 25H2, Windows Server 2012 R2, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows Server 2019 (Server Core installation), Windows 11 Version 24H2, Windows 10 Version 21H2, Windows Server 2016, Windows Server 2022, Windows 10 Version 1809
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49793

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019, Windows 11 version 26H1, Windows Server 2019 (Server Core installation), Windows Server 2016 (Server Core installation), Windows 11 Version 24H2, Windows 10 Version 22H2, Windows Server 2025, Windows 10 Version 21H2, Windows Server 2016, Windows 10 Version 1809, Windows 10 Version 1607, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows Server 2022
Provider severity
HIGH
Conflicts
1

CVE-2026-49792

Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 21H2, Windows Server 2016, Windows Server 2025, Windows 11 Version 25H2, Windows Server 2019, Windows 10 Version 22H2, Windows 10 Version 1809, Windows Server 2022, Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows 10 Version 1607, Windows 11 Version 24H2, Windows Server 2016 (Server Core installation), Windows Server 2019 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-49791

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 21H2, Windows 10 Version 1809, Windows 10 Version 22H2, Windows Server 2012 R2, Windows 11 Version 24H2, Windows Server 2012, Windows Server 2019 (Server Core installation), Windows Server 2019, Windows Server 2022, Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows Server 2012 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2025, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows 10 Version 1607
Provider severity
HIGH
Conflicts
1

CVE-2026-49790

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 21H2, Windows Server 2016 (Server Core installation), Windows 10 Version 1607, Windows Server 2012 R2, Windows Server 2019 (Server Core installation), Windows 10 Version 22H2, Windows 11 Version 25H2, Windows Server 2012, Windows 11 version 26H1, Windows Server 2012 (Server Core installation), Windows Server 2025, Windows Server 2019, Windows Server 2012 R2 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2016, Windows 10 Version 1809, Windows Server 2022
Provider severity
HIGH
Conflicts
2

CVE-2026-4979

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check

PUBLISHED
Vendor
stiofansisland
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49789

Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019, Windows 10 Version 1607, Windows Server 2016, Windows 10 Version 1809, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows 10 Version 21H2, Windows Server 2022, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 R2, Windows 10 Version 22H2, Windows 11 version 26H1, Windows Server 2019 (Server Core installation), Windows Server 2025, Windows 11 Version 24H2, Windows Server 2016 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-49788

Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 24H2, Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows Server 2025 (Server Core installation), Windows 10 Version 21H2, Windows Server 2022, Windows Server 2016 (Server Core installation), Windows 10 Version 22H2, Windows Server 2016, Windows 11 version 26H1, Windows Server 2025, Windows Server 2019, Windows 11 Version 25H2, Windows 10 Version 1607
Provider severity
HIGH
Conflicts
1

CVE-2026-49787

Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 version 26H1, Windows 10 Version 1607, Windows 11 Version 24H2, Windows Server 2022, Windows Server 2016, Windows Server 2019, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows 10 Version 1809, Windows 10 Version 21H2, Windows Server 2016 (Server Core installation), Windows 11 Version 25H2, Windows Server 2019 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-49784

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1809, Windows Server 2016, Windows Server 2025, Windows 10 Version 1607, Windows 11 Version 24H2, Windows Server 2022, Windows Server 2019 (Server Core installation), Windows 11 version 26H1, Windows 10 Version 22H2, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows Server 2019, Windows 11 Version 25H2, Windows Server 2016 (Server Core installation)
Provider severity
HIGH
Conflicts
2

CVE-2026-49783

Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2025, Windows Server 2019, Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows 10 Version 22H2, Windows Server 2022, Windows 10 Version 1607, Windows 10 Version 21H2, Windows 10 Version 1809, Windows 11 Version 24H2, Windows 11 version 26H1, Windows Server 2016
Provider severity
HIGH
Conflicts
1

CVE-2026-49782

Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.

PUBLISHED
Vendor
Elementor
Product
Elementor Website Builder
Provider severity
MEDIUM
Conflicts
0