Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,317 results · page 112 of 587
May 12, 2026SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protoCVE-2026-44863 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protoCVE-2026-44862 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protoCVE-2026-44861 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protoCVE-2026-44860 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 aCVE-2026-44859 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 aCVE-2026-44858 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 aCVE-2026-44857 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 aCVE-2026-44856 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 aCVE-2026-44855 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.CVE-2026-44854 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.CVE-2026-44853 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface.CVE-2026-44852 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation.CVE-2026-42191 · Other software · open-telemetry · reported by GitHubMedium 6.5
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.
- Product
- opentelemetry-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achCVE-2026-23827 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sendinCVE-2026-23826 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.CVE-2026-23825 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.CVE-2026-23824 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
- Product
- HPE Aruba Networking Wireless Operating System (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 all versions, FortiTokeCVE-2026-44279 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.5
An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 all versions, FortiTokenAndroid 5.2 all versions may allow attacker to disclose information via an exported Content Provider URI.
- Product
- FortiTokenAndroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
May 12, 2026A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker tCVE-2026-44278 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 2.3
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
- Product
- FortiClientWindows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
May 12, 2026A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticatCVE-2026-44277 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.
- Product
- FortiAuthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
May 12, 2026Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-42899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
May 12, 2026Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.CVE-2026-42898 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dynamics 365 (on-premises) version 9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a netwCVE-2026-42891 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.CVE-2026-42833 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dynamics 365 (on-premises) version 9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.CVE-2026-42823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Logic Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Kubewarden is a policy engine for Kubernetes.CVE-2026-42541 · Other software · kubewarden · reported by GitHubMedium 4.3
Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't the default) can craft a policy that makes use of the can_i host callback. The callback issues a SubjectAccessReview (SAR) requests to enumerate RBAC permissions of any user or service account across the cluster. can_i does not perform that check to enforce the context-aware allow-list and forwards the request directly to the callback handler, which executes a real SubjectAccessReview using policy-server privileges. This creates a policy-level authorization gap: can_i is effectively usable even when the policy has no context-aware resource grant. This is an information disclosure / reconnaissance issue, and not direct workload data exfiltration. The attacker learns permission information, such as whether specific service accounts can "get secrets", "create pods", or "bind clusterroles" in chosen namespaces. This vulnerability is fixed in .
- Product
- kubewarden-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET.CVE-2026-42348 · Other software · open-telemetry · reported by GitHubMedium 5.9
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
- Product
- opentelemetry-dotnet-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-41613 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2026-41107 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-41096 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.CVE-2026-41094 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Data Formulator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.CVE-2026-41089 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.CVE-2026-41086 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
- Product
- Windows Admin Center in Azure Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a netwCVE-2026-40416 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.CVE-2026-40415 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.CVE-2026-40406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.CVE-2026-40405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.CVE-2026-40379 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.CVE-2026-40374 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-40370 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
- Product
- Microsoft SQL Server 2016 Service Pack 3 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-40368 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-40365 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-40357 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-35439 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.CVE-2026-35438 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
- Product
- Windows Admin Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-35433 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
May 12, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a netwCVE-2026-35429 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a networCVE-2026-35424 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.CVE-2026-35423 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.CVE-2026-35422 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.