Browse CVE records published in 2026 CVE Archive, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 36700 matching CVEs · Page 6 of 734.
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
Published Jun 4, 2026 · Updated Jul 28, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Jul 28, 2026
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Jul 28, 2026
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Jul 28, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Jul 28, 2026
Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Jul 28, 2026
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.
Published Jul 28, 2026 · Updated Jul 28, 2026
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup() function passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length. This issue has been fixed in version 9.0.7.
Published Jul 28, 2026 · Updated Jul 28, 2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
Published Jul 28, 2026 · Updated Jul 28, 2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
Published Jul 28, 2026 · Updated Jul 28, 2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
Published Jul 28, 2026 · Updated Jul 28, 2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
Published Jul 28, 2026 · Updated Jul 28, 2026
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
Published Jul 24, 2026 · Updated Jul 28, 2026
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Published Jul 20, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.
Published Jul 28, 2026 · Updated Jul 28, 2026
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
Published Jul 14, 2026 · Updated Jul 28, 2026
Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.
Published Jul 28, 2026 · Updated Jul 28, 2026
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Jul 28, 2026
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
Published Jul 14, 2026 · Updated Jul 28, 2026
Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Published Jul 14, 2026 · Updated Jul 28, 2026
Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
Published Jul 14, 2026 · Updated Jul 28, 2026
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
Published Jul 24, 2026 · Updated Jul 28, 2026
Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.
Published Jul 17, 2026 · Updated Jul 28, 2026
Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.
Published Jul 14, 2026 · Updated Jul 28, 2026
