CVE-2026-69xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
744 records · Page 3 of 8
Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network.
UpdatedDependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
UpdatedUse after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network.
UpdatedUse after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
UpdatedUse after free in Windows Web Platform Storage allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-69707: Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability 7.8 High
Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
Updated Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
UpdatedOut-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
UpdatedAtals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp() deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized database operations including data deletion and extraction.
UpdatedAtlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because t
UpdatedSnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causin
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected record- CVE-2026-69694: Windows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability 7.0 High
Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.
Updated - CVE-2026-69693: Windows Device Association Broker Service Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
Updated Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedOut-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges over a network.
UpdatedHeap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
Updated- CVE-2026-69687: Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability 7.8 High
Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
Updated Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
UpdatedGeneration of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.
UpdatedServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
UpdatedUse after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-69681: Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability 8.0 High
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges over a network.
Updated Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network.
UpdatedOut-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.
UpdatedUse after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
UpdatedAuthentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.
Updated- CVE-2026-69674: Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability 5.5 Medium
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.
Updated Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
UpdatedUse of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Kernel allows an unauthorized attacker to execute code over a network.
UpdatedSKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
UpdatedMissing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every availab
UpdatedThe application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
UpdatedUncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without boundin
UpdatedMQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.
UpdatedXING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
UpdatedUse after free in Windows Accounts Control allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedInefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
UpdatedImproper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Notification allows an authorized attacker to elevate privileges locally.
UpdatedImproper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
UpdatedUse after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
UpdatedExposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
UpdatedMissing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
UpdatedIncorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.
UpdatedHeap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.
UpdatedHeap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
UpdatedInteger overflow or wraparound in Windows DNS allows an unauthorized attacker to deny service over a network.
UpdatedOut-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows iSCSI allows an authorized attacker to execute code over a network.
Updated- CVE-2026-69627: Windows Remote Desktop Licensing Service Information Disclosure Vulnerability 5.5 Medium
Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authorized attacker to disclose information locally.
Updated Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Updated- CVE-2026-69625: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability 8.0 High
Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a network.
Updated Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.
UpdatedHeap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.
UpdatedStack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows exFAT File System allows an authorized attacker to elevate privileges over a network.
UpdatedOut-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to disclose information locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedStack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
UpdatedAbsolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-69611: Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability 7.0 High
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
Updated Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.
UpdatedInteger overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Shell allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
UpdatedUse after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges over a network.
UpdatedHeap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
UpdatedIncorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
Updated- CVE-2026-69596: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
Updated