CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-41144

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize > fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitizatio

PUBLISHED

Vendor: nasa
Product: fprime
Provider severity: NONE
Conflicts: 1

CVE-2026-41143

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.

PUBLISHED

Vendor: YesWiki
Product: yeswiki
Provider severity: HIGH
Conflicts: 0

CVE-2026-41142

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, AcademySoftwareFoundation, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, openexr, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8
Provider severity: HIGH
Conflicts: 2

CVE-2026-41141

EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAddress parameter and resolves the owning entity (Contact, Lead, Account, or User) without performing an ACL check. An authenticated user with EmailTemplate read permission can extract all field values of any entity by supplying the target's email address, bypassing read: own or read: team ACL restrictions. This vulnerability is fixed in 9.3.

PUBLISHED

Vendor: espocrm
Product: espocrm
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41140

A flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the `extractall()` function in Poetry can be tricked into writing files to unintended locations on the system. This could lead to the creation or overwrite of critical system files, potentially compromising the integrity of the system.

PUBLISHED

Vendor: Red Hat, python-poetry, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift AI (RHOAI), poetry, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift Container Platform 4, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI)
Provider severity: HIGH, LOW
Conflicts: 3

CVE-2026-4114

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.

PUBLISHED

Vendor: SonicWall
Product: SMA1000
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41139

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, josdejong, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift Container Platform 4, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 9, Red Hat Developer Hub, Cryostat 4, mathjs, Red Hat Enterprise Linux 8, Self-service automation portal 2, Red Hat Enterprise Linux 10, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI)
Provider severity: HIGH
Conflicts: 3

CVE-2026-41138

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input is directly applied to the question parameter within the prompt template and it is reflected to the Python code without any sanitization. This vulnerability is fixed in 3.1.0.

PUBLISHED

Vendor: FlowiseAI
Product: Flowise
Provider severity: HIGH
Conflicts: 0

CVE-2026-41137

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

PUBLISHED

Vendor: FlowiseAI, FlowiseAI
Product: Flowise, flowise-components
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-41136

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely unin

PUBLISHED

Vendor: free5gc
Product: amf
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41135

free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a `router.Use()` call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently

PUBLISHED

Vendor: free5gc
Product: pcf
Provider severity: HIGH
Conflicts: 0

CVE-2026-41134

Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and in

PUBLISHED

Vendor: microsoft
Product: kiota
Provider severity: HIGH
Conflicts: 0

CVE-2026-41133

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions. This is a core authorization/session-consistency issue an

PUBLISHED

Vendor: pyload
Product: pyload
Provider severity: HIGH
Conflicts: 0

CVE-2026-41132

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.

PUBLISHED

Vendor: ckan
Product: ckan
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41131

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request. The preconditions for vulnerability are the model having relations which rely on condition evaluation and the user having caching enabled. OpenFGA v1.14.1 contains a fix.

PUBLISHED

Vendor: openfga
Product: openfga
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-41130

Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When `trustedHosts` is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. This allows an attacker to control the derived `baseUrl`, which is used in prefix validation inside `actionResourceJs()`. By supply

PUBLISHED

Vendor: craftcms
Product: cms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4113

An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.

PUBLISHED

Vendor: SonicWall
Product: SMA1000
Provider severity: HIGH
Conflicts: 0

CVE-2026-41129

Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Request Forgery. The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the <VolumeName> volume" and "Create assets in the <VolumeName> volume." Versions 4.17.9 and 5.9.15 patch the issue.

PUBLISHED

Vendor: craftcms
Product: cms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41128

Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` permission to remove arbitrary users from all user groups. While `_saveUserGroups()` enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty `groups` value removes all existing group memberships. Version 5.9.15 contains a patch.

PUBLISHED

Vendor: craftcms
Product: cms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41127

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows viewers to inject/overwrite captions Version 3.0.24 tightened the permissions on who is able to submit captions. No known workarounds are available.

PUBLISHED

Vendor: bigbluebutton
Product: bigbluebutton
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41126

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL." Version 3.0.24 has adjusted the handling of requests with incorrect checksum so that the default logoutURL is used. No known workarounds are available.

PUBLISHED

Vendor: bigbluebutton
Product: bigbluebutton
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41125

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M10 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions), blueplanet 155 TL3 (All versions), blueplanet 155

PUBLISHED

Vendor: Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens, Siemens
Product: blueplanet 100 TL3 GEN2, blueplanet 155 TL3, blueplanet 25.0 NX3-33.0 NX3, blueplanet 125 TL3 GEN2, blueplanet 150 TL3 GEN2, blueplanet 105 TL3 GEN2, blueplanet 3.0-5.0 NX1, blueplanet 3.0 NX3-20.0 NX3, blueplanet gridsave 137 TL3-S, blueplanet gridsave 110 TL3-S, blueplanet hybrid 6.0 NH3-12.0 NH3, blueplanet 360 NX3 M6, blueplanet 92.0 TL3 GEN2, blueplanet 165 TL3, blueplanet 150 TL3, blueplanet 50.0 NX3-60.0 NX3, blueplanet 125 NX3 M10, blueplanet 137 TL3, blueplanet gridsave 92.0 TL3-S, blueplanet 92.0 TL3, blueplanet 87.0 TL3, blueplanet 87.0 TL3 GEN2, blueplanet 165 TL3 GEN2, blueplanet 100 NX3 M8, blueplanet 105 TL3, blueplanet 110 TL3, blueplanet hybrid 10.0 TL3, blueplanet 125 TL3, blueplanet 155 TL3 GEN2
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-41124

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

PUBLISHED

Vendor: Dell
Product: PowerProtect Data Domain
Provider severity: LOW
Conflicts: 0

CVE-2026-41123

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in the RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.

PUBLISHED

Vendor: Dell
Product: PowerProtect Data Domain
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41122

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

PUBLISHED

Vendor: Dell
Product: PowerProtect Data Domain
Provider severity: HIGH
Conflicts: 0

CVE-2026-41121

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

PUBLISHED

Vendor: Dell
Product: Device Management Agent
Provider severity: HIGH
Conflicts: 0

CVE-2026-41120

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

PUBLISHED

Vendor: Dell
Product: Wyse Management Suite
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-4112

Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.

PUBLISHED

Vendor: SonicWall
Product: SMA1000
Provider severity: HIGH
Conflicts: 0

CVE-2026-41119

Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.

PUBLISHED

Vendor: Dell
Product: Live Optics
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41116

Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write.

PUBLISHED

Vendor: Dell
Product: Inventory Collector Client
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41115

An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users w

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Kafka
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41113

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.

PUBLISHED

Vendor: sagredo
Product: qmail
Provider severity: HIGH
Conflicts: 0

CVE-2026-4111

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the is

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Discovery 2, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.2, Red Hat Update Infrastructure 5, Red Hat AI Inference Server 3.3, Red Hat Update Infrastructure 5, Red Hat AI Inference Server 3.3, Red Hat Update Infrastructure 5, Red Hat OpenShift Container Platform 4.13, Red Hat Enterprise Linux 7, Red Hat Hardened Images, Red Hat Update Infrastructure 5, Red Hat OpenShift Container Platform 4.19, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat AI Inference Server 3.3, Red Hat Hardened Images, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.18, Red Hat Discovery 2, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Update Infrastructure 5, Red Hat AI Inference Server 3.2, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.15, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4.16, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat OpenShift Container Platform 4.14, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 2, Red Hat Insights proxy 1.5, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 8, Red Hat AI Inference Server 3.2, Red Hat Enterprise Linux 8, Red Hat Update Infrastructure 5, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.14, Red Hat Enterprise Linux 10, Red Hat Discovery 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenShift Container Platform 4.16, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat Enterprise Linux 7, Red Hat Update Infrastructure 5, Red Hat OpenShift Container Platform 4.17, Red Hat Enterprise Linux 6, Red Hat Insights proxy 1.5, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 9
Provider severity: HIGH
Conflicts: 1

CVE-2026-41109

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

PUBLISHED

Vendor: Microsoft
Product: Visual Studio Code
Provider severity: HIGH
Conflicts: 0

CVE-2026-41108

Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows 11 Version 24H2, Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 11 Version 23H2, Windows Server 2012 (Server Core installation), Windows 11 version 23H2, Windows Server 2012, Windows 10 Version 21H2, Windows 11 version 26H1, Windows 11 Version 25H2, Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows 10 Version 22H2, Windows Server 2016 (Server Core installation), Windows 10 Version 1607, Windows Server 2025 (Server Core installation)
Provider severity: HIGH
Conflicts: 1

CVE-2026-41107

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

PUBLISHED

Vendor: Microsoft
Product: Microsoft Edge (Chromium-based)
Provider severity: HIGH
Conflicts: 0

CVE-2026-41106

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

PUBLISHED

Vendor: Microsoft
Product: Microsoft 365 Copilot
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-41105

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

PUBLISHED

Vendor: Microsoft
Product: Azure Monitor Action Group notification system
Provider severity: HIGH
Conflicts: 0

CVE-2026-41104

Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.

PUBLISHED

Vendor: Microsoft
Product: Microsoft Planetary Computer Pro (GeoCatalog)
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-41103

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

PUBLISHED

Vendor: Microsoft, Microsoft
Product: Microsoft JIRA SAML SSO plugin, Microsoft Confluence SAML SSO plugin
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-41102

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

PUBLISHED

Vendor: Microsoft
Product: Microsoft PowerPoint for Android
Provider severity: HIGH
Conflicts: 0

CVE-2026-41101

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

PUBLISHED

Vendor: Microsoft
Product: Microsoft Word for Android
Provider severity: HIGH
Conflicts: 0

CVE-2026-41100

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Microsoft Excel for Android, Microsoft Word for Android, Microsoft OneNote for Android, Microsoft Loop for Android, Microsoft PowerPoint for Android, Microsoft 365 Copilot for Android
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-4110

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

PUBLISHED

Vendor: Unknown
Product: ultimate-woocommerce-auction-pro
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-41098

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.

PUBLISHED

Vendor: Microsoft
Product: Azure Stack Edge
Provider severity: HIGH
Conflicts: 0

CVE-2026-41097

Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows 11 Version 24H2, Windows 10 Version 1809, Windows 11 version 23H2, Windows Server 2022, Windows 11 Version 25H2, Windows Server 2019, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 22H2, Windows 10 Version 21H2, Windows Server 2019 (Server Core installation), Windows 11 Version 23H2
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-41096

Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows 11 version 26H1, Windows 11 Version 23H2, Windows 11 version 23H2, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 25H2
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-41095

Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2016 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025 (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 R2, Windows Server 2019 (Server Core installation), Windows Server 2019
Provider severity: HIGH
Conflicts: 1

CVE-2026-41094

Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.

PUBLISHED

Vendor: Microsoft
Product: Microsoft Data Formulator
Provider severity: HIGH
Conflicts: 0

CVE-2026-41092

Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows 10 Version 1809, Windows Server 2025, Windows 11 Version 25H2, Windows Server 2012, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows 10 Version 21H2, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 R2, Windows Server 2016 (Server Core installation), Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows 11 version 26H1, Windows Server 2012 (Server Core installation), Windows Server 2022, Windows 10 Version 1607, Windows Server 2016, Windows 11 Version 23H2, Windows 11 version 23H2, Windows Server 2019
Provider severity: HIGH
Conflicts: 1