🚨 CVE-2026-57475
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
🎖@cveNotify
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
🎖@cveNotify
🚨 CVE-2026-57476
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
🎖@cveNotify
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
🎖@cveNotify
🚨 CVE-2026-56169
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-57107
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50485
Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
🎖@cveNotify
Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
🎖@cveNotify
🚨 CVE-2026-50486
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50488
Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50489
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50490
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50491
Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50492
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code with a physical attack.
🎖@cveNotify
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code with a physical attack.
🎖@cveNotify
🚨 CVE-2026-50494
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
🎖@cveNotify
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
🎖@cveNotify
🚨 CVE-2026-50495
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
🎖@cveNotify
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
🎖@cveNotify
🚨 CVE-2026-50496
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-50497
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-50498
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
🎖@cveNotify
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
🎖@cveNotify
🚨 CVE-2026-50499
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50500
Use after free in Windows Netlogon allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Use after free in Windows Netlogon allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-45754
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
🎖@cveNotify
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
🎖@cveNotify
GitHub
[Mailer][Mailjet] Reject webhooks with missing or invalid Basic crede… · symfony/symfony@3e52bf5
…ntials
🚨 CVE-2026-63397
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.
🎖@cveNotify
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.
🎖@cveNotify
GitHub
GitHub - remorses/genql: Type safe TypeScript client for any GraphQL API
Type safe TypeScript client for any GraphQL API. Contribute to remorses/genql development by creating an account on GitHub.
🚨 CVE-2026-16118
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
🎖@cveNotify
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
🎖@cveNotify