🚨 CVE-2025-49794
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
🎖@cveNotify
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
🎖@cveNotify
🚨 CVE-2025-49796
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.
🎖@cveNotify
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.
🎖@cveNotify
🚨 CVE-2025-6020
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
🎖@cveNotify
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
🎖@cveNotify
🚨 CVE-2025-7425
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
🎖@cveNotify
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
🎖@cveNotify
🚨 CVE-2026-9165
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
🎖@cveNotify
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
🎖@cveNotify
🚨 CVE-2026-42976
Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-49179
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-50472
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-54113
Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-54984
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
🎖@cveNotify
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
🎖@cveNotify
🚨 CVE-2026-56174
Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-57104
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-59122
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-59124
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-59125
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-59127
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-59128
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
🎖@cveNotify
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-59130
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
🎖@cveNotify
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-59132
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-59134
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-59135
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
🎖@cveNotify
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
🎖@cveNotify