Low · CVSS 2.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.
The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.
The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssh from 3.0.1 before 5.2.11.8, 5.5.2.1, and 6.0.1. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.
Published Jun 10, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.3
Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.5
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.5
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 8.8
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.
Published Jun 19, 2026 · Updated Sep 24, 2026
Critical · CVSS 9.6
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
Published Jun 19, 2026 · Updated Sep 24, 2026
Critical · CVSS 9.1
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
Published Jun 4, 2026 · Updated Sep 24, 2026
Critical · CVSS 10
Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.
Published Jun 4, 2026 · Updated Sep 24, 2026
Medium · CVSS 6.5
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Published Jun 4, 2026 · Updated Sep 24, 2026
High · CVSS 7.7
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
Published Jun 4, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 8.1
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 8.8
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.5
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Critical · CVSS 9.8
Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.5
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.5
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 8.4
Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 8.1
Integer overflow or wraparound in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 8.1
Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Exposure of sensitive information to an unauthorized actor in Windows Hyper-V allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Medium · CVSS 5.5
Incorrect calculation of buffer size in Windows VMSwitch allows an authorized attacker to deny service locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.5
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
High · CVSS 7.8
Integer overflow or wraparound in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
