CVE-2026-96xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
522 records · Page 1 of 6
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedStack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-96990: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound 8.2 High
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Updated - CVE-2026-96962: Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code 3.7 Low
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
Updated Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
UpdatedAllocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
UpdatedInefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
UpdatedImproper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
UpdatedStack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
UpdatedNull pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
UpdatedUse after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-96948: Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability 5.5 Medium
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
Updated Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
UpdatedUncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
UpdatedInsertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.
UpdatedInteger overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
UpdatedWeak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
UpdatedTime-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-96938: Windows Distributed File System (DFS) Elevation of Privilege Vulnerability 6.7 Medium
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
Updated Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
UpdatedExposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.
UpdatedUse after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
UpdatedUntrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
UpdatedUntrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
UpdatedMissing authorization in DNS Server allows an authorized attacker to perform tampering locally.
UpdatedInteger underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
UpdatedUntrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-96921: Windows Message Queuing Queue Manager Information Disclosure Vulnerability 5.5 Medium
Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.
Updated - CVE-2026-96920: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability 7.8 High
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
Updated Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
UpdatedInteger overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
UpdatedInteger overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
UpdatedImproper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
UpdatedUntrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.
UpdatedThe AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
UpdatedThe Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
UpdatedThe Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
UpdatedThe Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an ar
UpdatedThe Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.
UpdatedThe Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
UpdatedA vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early
UpdatedThe Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
UpdatedThe Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.
Updated- CVE-2026-96895: WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes 6.8 Medium
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Updated The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses a
UpdatedGitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements i
UpdatedA flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond
UpdatedA vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname leads to out-of-bounds write. The attack may be initiated remotely.
UpdatedA Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committ
UpdatedA flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
UpdatedA BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
UpdatedThe Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
UpdatedA security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue repor
Updatedpgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade
UpdatedA vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used
UpdatedA vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor
UpdatedA vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be u
UpdatedImproper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.
UpdatedImproper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
UpdatedThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any boa
UpdatedThe SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will
UpdatedInformation disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.
UpdatedOut-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
UpdatedExposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
Updated- CVE-2026-96864: Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability 9.8 Critical
Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
Updated Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
UpdatedOut-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
UpdatedOut-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.
UpdatedMissing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
UpdatedFiles or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.
Updated