CVE-2026-72xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
950 records · Page 1 of 10
Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedUse of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows DNS allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network.
UpdatedStack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in IP Helper allows an unauthorized attacker to execute code over a network.
UpdatedUncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.
UpdatedUse after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-72978: Active Directory Federation Services (AD FS) Denial of Service Vulnerability 5.9 Medium
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Updated Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
UpdatedBuffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-72971: Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability 5.5 Medium
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Updated Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-72969: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
Updated - CVE-2026-72968: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
Updated Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
UpdatedMissing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
UpdatedUse after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally.
UpdatedMissing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.
UpdatedUse after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-72959: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Updated Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally.
UpdatedUntrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Updated- CVE-2026-72955: Windows Application Compatibility Cache Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.
Updated Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.
Updated- CVE-2026-72950: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Updated Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.
UpdatedRelative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedInteger underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Storage Port Driver allows an authorized attacker to elevate privileges locally.
UpdatedUse of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Schannel allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-72939: Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability 6.5 Medium
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.
Updated Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally.
UpdatedUse after free in Windows SMB Client allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-72934: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
Updated Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.
UpdatedBuffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
Updated- CVE-2026-72931: Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability 4.7 Medium
Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.
Updated - CVE-2026-72930: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability 7.0 High
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.
Updated Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows DNS allows an authorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Winsock allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-72926: Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability 7.0 High
Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
Updated - CVE-2026-72925: SWC HTML minifier may allow script element breakout when minifying embedded JSON 6.1 Medium
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a clo
Updated GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user's non-loopback local IP addresses by other hosts that can route to the user's machine. This behav
UpdatedThe OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume unc
UpdatedAutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_platform/backend/backend/api/features/integrations/router.py webhook_ingress_generic route selected get_webhook_manager(provider) from the untrusted provider URL segment without verifying webhook.provider, allowing a request to /compass/webho
UpdatedSeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24
Updated- CVE-2026-72920: SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control 9.8 Critical
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed i
Updated Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only
UpdatedRocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently
UpdatedAnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace
UpdatedMastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVA
UpdatedMastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collectio
Updated- CVE-2026-72914: Mastodon: Exhausting data by an unauthenticated request to the admin retention API 7.5 High
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused
Updated Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands
UpdatedCyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform h
Updated- CVE-2026-72911: ERPNext: Possibility of server-side template injection due to missing validation 9.9 Critical
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inje
Updated - CVE-2026-72910: ERPNext: Unauthorised modification of master data due to missing validation 7.1 High
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/pu
Updated ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company fin
UpdatedERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 a
UpdatedERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in v
Updated- CVE-2026-72906: ERPNext: Unauthorised triggering of automated emails due to missing validation 4.3 Medium
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in
Updated Further research determined the issue is not a vulnerability.
Updated · Rejected recordFirecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/api/src/lib/extract/helpers/dereference-schema.ts. The affected code invokes the json-schema-ref-parser dependency with default resolver sett
UpdatedTabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFold
Updated- CVE-2026-72902: Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById 9.9 Critical
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCo
Updated Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process
UpdatedMetabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
UpdatedMetabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
UpdatedMetabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Updated