Total
420421 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-68848 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-68846 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.1 HIGH |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68845 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-68841 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-68840 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.0 HIGH |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-68839 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 9.8 CRITICAL |
| Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-68838 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.0 HIGH |
| Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68835 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.1 HIGH |
| Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68834 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.0 HIGH |
| Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68833 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 6.8 MEDIUM |
| Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. | |||||
| CVE-2026-68832 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.8 HIGH |
| Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-68831 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 5.5 MEDIUM |
| Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-68830 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 5.5 MEDIUM |
| Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-68827 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.0 HIGH |
| Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-63416 | 2026-09-24 | N/A | 3.7 LOW | ||
| draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7. | |||||
| CVE-2026-62801 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 6.5 MEDIUM |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-62759 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.5 HIGH |
| Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network. | |||||
| CVE-2026-62706 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.8 HIGH |
| Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-62694 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.0 HIGH |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-62369 | 2026-09-24 | N/A | 8.1 HIGH | ||
| KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1. | |||||