CVE-2026-85xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
752 records · Page 2 of 8
Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-85867: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability 7.8 High
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Updated Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
UpdatedImproper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.
UpdatedImproper privilege management in Python allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.
UpdatedNull pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.
UpdatedOut-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
UpdatedInsertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.
UpdatedUse after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
UpdatedUse after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
UpdatedRelease of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedImproper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.
UpdatedUse after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.
UpdatedUse of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
UpdatedUse of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows DHCP Server allows an authorized attacker to execute code over a network.
UpdatedFiles or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedBuffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-85833: Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability 7.8 High
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
Updated Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally.
UpdatedDouble free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
UpdatedUse after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
UpdatedImproper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
UpdatedReliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information over an adjacent network.
UpdatedOut-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
UpdatedFiles or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
UpdatedUse after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.
UpdatedUse after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-85809: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 9.8 Critical
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Updated - CVE-2026-85808: Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability 7.5 High
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
Updated Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
UpdatedInteger underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
UpdatedImproperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
UpdatedUse after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
UpdatedNumeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally.
UpdatedExposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally.
Updated- CVE-2026-85792: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 9.8 Critical
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Updated Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordIncomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace. To remediate this issue, users should upgrade to version 1.0.23.
UpdatedAn incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. To remediate this issue, users should upgrade to version 1.1.7 or abov
UpdatedImproper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.
UpdatedCrypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key. The header parser accepts any number of recipient stanzas, and unwrap_file_key tries every identity against every X25519 stanza. Each attempt runs a scalar multiplication, an HKDF and a ChaCha20-Poly1305 open. The header MAC
UpdatedUnverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem
UpdatedA flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent
UpdatedSSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralize
UpdatedMailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from u
Updated- CVE-2026-85750: Piwigo arbitrary file read and remote code execution via insecure image processing 7.2 High
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In mor
Updated MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message `id` to `mailscanner/quarantine_action.php`. The action path calls `quarantine_list_items()` in `mai
UpdatedMariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vuln
UpdatedDistribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Do
Updated- CVE-2026-85746: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections 9.9 Critical
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially cra
Updated MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spa
UpdatedLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A caller who can upload a Markdown or textpack document can supply an external image URL using NAT64 64:ff
UpdatedTREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and i
Updated- CVE-2026-85734: LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks 9.1 Critical
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authentic
Updated FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, softwa
Updatedoras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side
Updatedoras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a
Updatedsmol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The pars
UpdatedLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency acces
Updated- CVE-2026-85724: Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass 9.6 Critical
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write acce
Updated The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who
Updated