CVE-2026-71498 - node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
CVE ID :CVE-2026-71498
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-71498
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-71554 - h2: Duplicate Host header could facilitate request smuggling
CVE ID :CVE-2026-71554
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-71554
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-71555 - PILOS: Reverse tabnabbing in room description
CVE ID :CVE-2026-71555
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
Severity: 4.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-71555
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
Severity: 4.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-7405 - TIF File Parsing Out-of-Bounds Read in certain Autodesk products
CVE ID :CVE-2026-7405
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-7405
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-7406 - BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
CVE ID :CVE-2026-7406
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-7406
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-7867 - Udisks2: udisks2: local privilege escalation via as-user option spoofing
CVE ID :CVE-2026-7867
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-7867
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-8325 - PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit
CVE ID :CVE-2026-8325
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-8325
Published : Aug. 6, 2026, 10:18 p.m. | 1 hour, 51 minutes ago
Description :A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15805 - Rejected reason: This CVE ID has been rejected or
CVE ID :CVE-2026-15805
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15805
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-17264 - Medixant RadiAnt DICOM Out-of-bounds write
CVE ID :CVE-2026-17264
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-17264
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-49163 - Application Insights Profiler Elevation of Privilege Vulnerability
CVE ID :CVE-2026-49163
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-49163
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-50481 - Azure Active Directory Elevation of Privilege Vulnerability
CVE ID :CVE-2026-50481
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-50481
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-50515 - Azure Service Bus Remote Code Execution Vulnerability
CVE ID :CVE-2026-50515
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-50515
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-56161 - Azure Logic Apps Information Disclosure Vulnerability
CVE ID :CVE-2026-56161
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-56161
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-56162 - Azure SQL Database Elevation of Privilege Vulnerability
CVE ID :CVE-2026-56162
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-56162
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-59115 - Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
CVE ID :CVE-2026-59115
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-59115
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-59118 - Microsoft Power Apps Elevation of Privilege Vulnerability
CVE ID :CVE-2026-59118
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-59118
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62830 - Azure SRE Agent Elevation of Privilege Vulnerability
CVE ID :CVE-2026-62830
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62830
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62836 - Azure SQL Managed Instance Elevation of Privilege Vulnerability
CVE ID :CVE-2026-62836
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62836
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62873 - Microsoft 365 Admin Center Elevation of Privilege Vulnerability
CVE ID :CVE-2026-62873
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62873
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62896 - Microsoft Teams Elevation of Privilege Vulnerability
CVE ID :CVE-2026-62896
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62896
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62918 - Microsoft Teams Spoofing Vulnerability
CVE ID :CVE-2026-62918
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62918
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...