CVE-2026-50342: Windows MIDI Service Module Elevation of Privileges Vulnerability
Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
Advisories tracked
20,906
● Live advisory feed
Security Advisory Fusion for CSIRTs, SOCs & Defenders
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Known exploited
1,782
Sources online
24
Last sync
4H AGO
CVE-2026-49165: Microsoft Windows App Store Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
CVE-2026-54990: Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-59818: etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
CVE-2026-17792: Chromium: CVE-2026-17792 Inappropriate implementation in Credential Management
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-50358: Windows Media Elevation of Privilege Vulnerability
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
CVE-2026-55000: Windows USB Print Driver Elevation of Privilege Vulnerability
Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-44806: Windows Secure Channel Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
CVE-2026-17793: Chromium: CVE-2026-17793 Inappropriate implementation in Messages
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14258: Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling
CVE-2026-15776: Chromium: CVE-2026-15776 Type Confusion in V8
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14035: Chromium: CVE-2026-14035 Insufficient policy enforcement in Bluetooth
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-50685: Windows DHCP Server Remote Code Execution Vulnerability
Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.
CVE-2026-60000: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating
CVE-2026-16493: Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
CVE-2026-13806: Chromium: CVE-2026-13806 Insufficient validation of untrusted input in Accessibility
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-56852: Infinite loop on invalid input in golang.org/x/text
CVE-2026-59848: Libssh: libssh: denial of service via sftp responses with unknown request ids
CVE-2026-59843: Libssh: libssh: denial of service via zero advertised channel packet size
CVE-2026-59845: Libssh: libssh: denial of service via unchecked proxycommand fork() failure
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ
CVE-2026-64313: crypto: ecc - Fix carry overflow in vli multiplication
CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps
CVE-2026-50465: Windows DNS Client Tampering Vulnerability
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
CVE-2026-63819: f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
CVE-2026-47303: ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-63858: netfilter: nf_tables: add hook transactions for device deletions
CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-57986: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-13875: Chromium: CVE-2026-13875 Insufficient validation of untrusted input in GPU
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-53329: drm/amd/display: Use krealloc_array() in dal_vector_reserve()
CVE-2026-58619: Windows Sensor Data Service Elevation of Privilege Vulnerability
Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
CVE-2026-56648: Windows NFS Server Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.
CVE-2026-57084: Windows File Explorer Information Disclosure Vulnerability
Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
CVE-2026-14004: Chromium: CVE-2026-14004 Inappropriate implementation in CSS
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14034: Chromium: CVE-2026-14034 Inappropriate implementation in WebXR
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-55952: TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension
CVE-2026-14036: Chromium: CVE-2026-14036 Insufficient policy enforcement in Bluetooth
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14041: Chromium: CVE-2026-14041 Insufficient policy enforcement in Serial
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14063: Chromium: CVE-2026-14063 Out of bounds memory access in Chromecast
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14072: Chromium: CVE-2026-14072 Incorrect security UI in SplitView
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14073: Chromium: CVE-2026-14073 Insufficient policy enforcement in WebXR
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK
CVE-2026-44621: Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated
CVE-2026-14074: Chromium: CVE-2026-14074 Side-channel information leakage in WebAuthentication
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-14105: Chromium: CVE-2026-14105 Insufficient policy enforcement in Speech
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
CVE-2026-55041: Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.