CVE watch

CVE-2026-100210 published: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100209 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100207 published: Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

CVE-2026-100205 published: Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

CVE-2026-100203 published: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

CVE-2026-100202 published: Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

CVE-2026-100201 published: Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

CVE-2026-100200 published: Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

CVE-2026-100133 published: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the p...

CVE-2026-108378 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc valu...

CVE-2026-108377 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro ...

CVE-2026-108376 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled refe...

CVE-2026-108375 published: dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string...

CVE-2026-106176 published: A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests

CVE-2026-106175 published: A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 thro...

CVE-2026-106173 published: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

CVE-2026-106172 published: A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox C...

CVE-2026-106171 published: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege...

CVE-2026-106170 published: An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via cra...

CVE-2026-105445 published: An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking th...