CVE watch
Every disclosure pulled from the NVD feed, filterable by severity.
CVE-2026-83584 published: Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-83583 published: Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100217 published: Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100216 published: Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100215 published: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
Details →CVE-2026-100214 published: Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
Details →CVE-2026-100212 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100211 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100210 published: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100209 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Details →CVE-2026-100207 published: Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Details →CVE-2026-100205 published: Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100203 published: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100201 published: Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-100200 published: Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
Details →CVE-2026-108378 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc valu...
Details →CVE-2026-108377 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro ...
Details →CVE-2026-108376 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled refe...
Details →CVE-2026-108375 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string...
Details →CVE-2026-104085 published: odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can ...
Details →