CVE-2026-38969 ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling.
Information published.
Categories: Microsoft
CVE-2026-38968 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh...
Information published.
Categories: Microsoft
CVE-2026-14191 WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader
Information published.
Categories: Microsoft
CVE-2026-53269 netfilter: synproxy: add mutex to guard hook reference counting
Information published.
Categories: Microsoft
CVE-2026-56000 xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()
Information published.
Categories: Microsoft
CVE-2026-55999 xorg-server / xwayland glamor font atlas Heap Buffer Overflow
Information published.
Categories: Microsoft
CVE-2026-56002 libXfont2 PCF Font Parsing Heap Buffer Overflow
Information published.
Categories: Microsoft
CVE-2026-56003 libXfont2 computeProps Property Buffer Heap Buffer Overflow
Information published.
Categories: Microsoft
CVE-2026-56001 libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
Information published.
Categories: Microsoft
CVE-2026-60002 ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
Information published.
Categories: Microsoft
CVE-2026-59999 In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Information published.
Categories: Microsoft
CVE-2026-60000 sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
Information published.
Categories: Microsoft
CVE-2026-60001 sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
Information published.
Categories: Microsoft
CVE-2026-59995 sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Information published.
Categories: Microsoft
CVE-2026-59996 scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
Information published.
Categories: Microsoft
CVE-2026-59997 internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
Information published.
Categories: Microsoft
CVE-2026-50656 Microsoft Defender Elevation of Privilege Vulnerability
Microsoft has released an update to the Microsoft Malware Protection Engine that addresses the vulnerability identified by CVE-2026-50656. Please see the FAQ for more information on how to check if the new version has been installed.
Categories: Microsoft
CVE-2026-42980 NT OS Kernel Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Categories: Microsoft
CVE-2026-58525 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Categories: Microsoft
CVE-2026-45638 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Categories: Microsoft
