Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25,390 results · page 121 of 508
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Improve validation and configuration of ACR masks Currently there are seveCVE-2026-53370 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Improve validation and configuration of ACR masks Currently there are several issues on the user space ACR mask validation and configuration. - The validation for user space ACR mask (attr.config2) is incomplete, e.g., the ACR mask could include the index which belongs to another ACR events group, but it's not validated. - An early return on an invalid ACR mask caused all subsequent ACR groups to be skipped. - The stale hardware ACR mask (hw.config1) is not cleared before setting new hardware ACR mask. The following changes address all of the above issues. - Figure out the event index group of an ACR group. Any bits in the user-space mask not present in the index group are now dropped. - Instead of an early return on invalid bits, drop only the invalid portions and continue iterating through all ACR events to ensure full configuration. - Explicitly clear the stale hardware ACR mask for each event prior to writing the new configuration. Besides, a non-leader event member of ACR group could be disabled in theory. This could cause bit-shifting errors in the acr_mask of remaining gro
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verificationCVE-2026-53369 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage f2fs_need_dentry_marCVE-2026-53368 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do_sync_file // inline inode - f2fs_write_inode // inode folio is dirty - f2fs_write_checkpoint - f2fs_flush_merged_writes - f2fs_sync_node_pages - f2fs_fsync_node_pages // no dirty node - f2fs_need_inode_block_update // return true - f2fs_fsync_node_pages // inode dirtied - f2fs_need_dentry_mark //return true - f2fs_flush_nat_entries - f2fs_write_checkpoint end - __write_node_folio // inode with DENT_BIT_SHIFT set SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set The state observed by f2fs_need_den
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing thCVE-2026-53367 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avc_audit_required() rather than recomputing based on the currently requested permissions and distinguishing the denied versus allowed cases. As a result, some permission checks were not being audited, e.g. directory write checks after a previously cached directory search check. [PM: line wrap tweaks]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 16, 2026Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm.CVE-2026-44182 · Other software · jupyter-server · reported by GitHubCritical 10
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (--- for new documents, ... for end-of-document) to generate multiple resources, potentially creating arbitrary types, such as privileged pods. The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, such as kernel_working_dir that are used when rendering the manifest and are all vectors for YAML injection. This issue has been fixed in version 3.3.0.
- Product
- enterprise_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm.CVE-2026-44181 · Other software · jupyter-server · reported by GitHubCritical 10
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection (SSTI). By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service. The code can use or steal the Kubernetes service account token, which can steal Kubernetes secrets and be used to fully compromise the Kubernetes cluster by scheduling a privileged pod or a pod with a hostPath volume mount. This issue has been fixed in version 3.3.0.
- Product
- enterprise_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm.CVE-2026-44180 · Other software · jupyter-server · reported by GitHubCritical 9.8
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 (root), and this restriction can be bypassed using a specially crafted KERNEL_UID or KERNEL_GID value. This input validation vulnerability allows running Jupyter kernels as root, which can be dangerous as it allows more attack surface, and may lead to container escapes, compromising the worker node and all workloads running on it. Repeated exploitation can compromise all worker nodes, and thus the entire Kubernetes cluster. It is possible to specify volume mounts, so one vector for a container escape is to use a hostPath R/W volume mount, use this UID/GID bypass to run as root, and then gain code execution in the underlying worker node by creating a crontab entry in the mounted host file system. This issue has been fixed in version 3.0.0.
- Product
- enterprise_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request.CVE-2026-57896 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 6.9
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentCVE-2026-61389 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 7.3
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request.CVE-2026-60140 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 6.9
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentCVE-2026-60063 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 7.3
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the systemCVE-2026-6424 · Other software · ESET, spol. s.r.o. · reported by security@eset.comMedium 6.7
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system
- Product
- ESET Endpoint Antivirus for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the pagCVE-2026-53366 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 14, 2026Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.CVE-2026-58545 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-58532 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-56644 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-56643 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50688 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50687 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50673 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50670 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50493 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50478 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50477 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-50475 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comtalosintelligence.com
Jul 14, 2026Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.CVE-2026-50463 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.CVE-2026-50459 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50436 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.CVE-2026-50429 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50423 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-50419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.3
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50397 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-50396 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-50393 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-50392 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50390 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50377 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50329 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.CVE-2026-0515 · Other software · BlackBerry Ltd · reported by secure@blackberry.comMedium 6.2
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.
- Product
- QNX Software Development Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jul 14, 2026Out-of-bounds read in Windows Kernel allows an authorized attacker to bypass a security feature locally.CVE-2026-58614 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows Kernel allows an authorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally.CVE-2026-58602 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-54132 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50354 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-50316 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-50300 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-50296 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.CVE-2026-50294 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.