Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
398,769 results · page 379 of 7976
Oct 13, 2026Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands byCVE-2026-110206 · Other software · RooCodeInc · reported by VulnCheckHigh 7.7
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.
- Product
- Roo-Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob chCVE-2026-110205 · Other software · RooCodeInc · reported by VulnCheckHigh 7.7
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.
- Product
- Roo-Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${CVE-2026-110204 · Other software · RooCodeInc · reported by VulnCheckHigh 7.7
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.
- Product
- Roo-Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking reCVE-2026-110203 · Other software · RooCodeInc · reported by VulnCheckHigh 7.7
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.
- Product
- Roo-Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by CVE-2026-110202 · Other software · RooCodeInc · reported by VulnCheckHigh 7.7
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.
- Product
- Roo-Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension suchCVE-2026-110130 · Other software · Finsys · reported by VulnCheckCritical 10
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
- Product
- dockhand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce andCVE-2026-110112 · Other software · Finsys · reported by VulnCheckCritical 9.2
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
- Product
- dockhand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unCVE-2026-110111 · Other software · vatesfr · reported by VulnCheckHigh 7.7
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
- Product
- xen-orchestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026A flaw was found in device-mapper-persistent-data.CVE-2026-110036 · Other software · Red Hat · reported by Red HatLow 3.3
A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 13, 2026Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-109453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substCVE-2026-109429 · Other software · mistralai · reported by VulnCheckHigh 8.7
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing CVE-2026-109428 · Other software · mistralai · reported by VulnCheckHigh 8.7
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.CVE-2026-108471 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-108468 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.CVE-2026-108467 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.CVE-2026-108466 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.CVE-2026-108465 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.CVE-2026-108464 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-108463 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-108462 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-108461 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.CVE-2026-108460 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-108458 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.CVE-2026-108457 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.CVE-2026-108400 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-108399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.CVE-2026-108398 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
- Product
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-108396 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-108136 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.CVE-2026-108135 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-108134 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-108133 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows Server 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-108132 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-108131 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.CVE-2026-108130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.CVE-2026-108129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.CVE-2026-108128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.CVE-2026-108127 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on tCVE-2026-107607 · Other software · Swann Communications · reported by ics-cert@hq.dhs.govMedium 6.9
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
- Product
- SWIFI-SE2KIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on tCVE-2026-107606 · Other software · Swann Communications · reported by ics-cert@hq.dhs.govMedium 6.9
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
- Product
- SWIFI-SE2KIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on tCVE-2026-107605 · Other software · Swann Communications · reported by ics-cert@hq.dhs.govMedium 5.9
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.
- Product
- SWIFI-SE2KIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106625 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.CVE-2026-105733 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.CVE-2026-105732 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.
- Product
- Sysinternals Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.CVE-2026-105731 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.CVE-2026-105729 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
- Product
- Windows Sysinternals Process Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.CVE-2026-105728 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Dynamics NAV 2018
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026External control of file name or path in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.CVE-2026-105727 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
External control of file name or path in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Dynamics NAV 2018
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.CVE-2026-105726 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.
- Product
- Microsoft Defender for Endpoint for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.CVE-2026-105725 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
- Product
- Windows Security App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.