CVE-2026-72986 is a heap-based buffer overflow vulnerability in the Graphic Fonts component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes addressing this issue.
CVE-2026-69846 is an integer overflow or wraparound vulnerability in the Windows Secure Kernel Mode of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker with high privileges to elevate their privileges further. The vulnerability affects multiple specific Windows 10 builds prior to their respective fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-69742 is a high-severity integer overflow or wraparound vulnerability in Microsoft Office Publisher, part of Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to fixed releases. Microsoft has issued official fixes for the affected versions.
CVE-2026-69734 is an integer overflow or wraparound vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Multiple affected versions prior to specific fixed releases are impacted. Microsoft has released official fixes for this vulnerability.
CVE-2026-69469 is an integer overflow or wraparound vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple builds of Windows 10 Version 1809 and later. This flaw allows an unauthorized attacker with physical access to elevate privileges on the affected system. The vulnerability has a CVSS 3.1 base score of 6.6, indicating a medium severity level. Microsoft has released official fixes for all affected versions.
CVE-2026-71336 is an integer overflow or wraparound vulnerability in the Windows Work Folder Service affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has released official fixes for all affected versions.
CVE-2026-70351 is an integer overflow or wraparound vulnerability in the Microsoft WebP Image Extension. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions 1.0.0.0 up to but not including 1.2.31.0. Microsoft has released an official fix in version 1.2.31.0. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-69631 is an integer overflow or wraparound vulnerability in the Windows DNS component affecting multiple versions of Microsoft Windows including Windows 10 Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has issued official fixes for all affected versions.
CVE-2026-69594 is a heap-based buffer overflow vulnerability in the Microsoft Local Security Authority Server (lsasrv) component of Windows 11 Version 24H2. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity with a CVSS score of 7.8. Microsoft has released official fixes for affected versions.
CVE-2026-69608 is an integer overflow or wraparound vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other specified versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds. No known exploits are reported in the wild.
CVE-2026-69408 is a critical integer overflow or wraparound vulnerability in Microsoft Windows Media Foundation affecting multiple Windows 10 versions including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Official patches have been released for all affected versions.
CVE-2026-68832 is an integer overflow or wraparound vulnerability in the Windows NTFS component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.
CVE-2026-86314 is an integer overflow vulnerability in the source-bounds check within the Memory::init() function of Samsung Opensource Walrus. This flaw allows a remote attacker to craft a WebAssembly module that triggers a 32-bit unsigned addition wraparound, bypassing bounds checks and causing an out-of-bounds heap read and denial of service. The vulnerability affects the Walrus component identified by commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443. No affected versions or patches are explicitly stated.
CVE-2026-86139 is an integer overflow vulnerability in the xmlURIEscapeStr function of libxml2 before version 2.15.4. This flaw could lead to high impact on confidentiality and integrity, with limited impact on availability. The vulnerability has a medium severity rating and affects versions prior to 2.15.4.
A vulnerability in libxml2 before version 2.15.4 allows an integer overflow in the xmlDictAddQString function, leading to a heap-based buffer overflow. This flaw can result in high confidentiality and integrity impact, with a low availability impact. The vulnerability has a CVSS score of 6.9, indicating a medium severity level.
CVE-2026-84965 is an integer wraparound vulnerability in the BSON library's JSON parsing code used by the MongoDB C Driver. It occurs during allocation size calculation, which may lead to freeing a buffer while a subsequent copy operation writes to a stale pointer. On 32-bit size builds, an unauthenticated attacker can supply a large JSON input to cause the application to crash, resulting in denial of service. The vulnerability affects MongoDB C Driver versions from 1.10.0 up to but not including 1.30.9, and from 2.0.0 up to but not including 2.5.2. The CVSS 4.0 base score is 5.9, indicating medium severity.
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1,029,000) enabled fee cash-back and burn accounting without overflow protection. This issue has been patched in version 3.9.9.