CVE-2026-83766 is an incorrect authorization vulnerability in Windows Hyper-V on Windows 10 Version 1607 and related builds. It allows an authorized attacker on an adjacent network to bypass a security feature. The vulnerability has a medium severity with a CVSS score of 4.2. Official fixes have been released for affected versions.
CVE-2026-83764 is an incorrect authorization vulnerability in the Windows Clipboard User Service affecting multiple builds of Microsoft Windows 10 Version 1809 and related updates. An authorized attacker with local access can exploit this flaw to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.
CVE-2026-69640 is an incorrect authorization vulnerability in the Windows Key Distribution Center component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to bypass a security feature over a network. The vulnerability has a medium severity rating with a CVSS score of 5.3. Microsoft has released official fixes for all affected versions.
CVE-2026-88162 is a medium severity vulnerability in Microsoft Windows 10 Version 1607 related to improper authorization in the Encrypting File System (EFS). It allows an authorized local attacker to perform tampering. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-84011 is an incorrect authorization vulnerability in the Windows SMB Client on Microsoft Windows 11 version 23H2. It allows an authorized local attacker to bypass a security feature. The issue affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official fixes for this vulnerability. The CVSS v3.1 base score is 5.5, indicating a medium severity level.
CVE-2026-70299 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving improper access control in the Windows Bind Filter Driver. This flaw allows an authorized local attacker to elevate privileges, potentially gaining higher system rights. The vulnerability affects specific builds of Windows 11 23H2 prior to the fixed versions 10.0.22631.7652 and 10.0.26100.33650. Microsoft has released official patches to address this issue.
CVE-2026-70280 is an incorrect authorization vulnerability in Windows Hello on Microsoft Windows 10 Version 21H2. It allows an authorized attacker with high privileges to locally bypass a security feature. The vulnerability has a medium severity rating with a CVSS score of 4.4. Microsoft has released official fixes for affected versions.
CVE-2026-70087 is an incorrect authorization vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an authorized local attacker to bypass a security feature, potentially leading to unauthorized actions. The vulnerability has a medium severity rating and has been officially fixed in specific Windows updates.
CVE-2026-70083 is a medium severity vulnerability in Microsoft Windows 10 Version 1607 and related versions involving incorrect authorization in the DNS Server component. This flaw allows an authorized local attacker with low privileges to perform tampering actions. The vulnerability does not impact confidentiality or availability but can affect integrity. Microsoft has issued official fixes for all affected versions.
CVE-2026-70057 is an incorrect authorization vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to bypass a security feature. The vulnerability has a medium severity rating and has been officially fixed in specific Windows 10 builds.
CVE-2026-69971 is a medium-severity vulnerability in Microsoft Windows 11 Version 24H2 involving incorrect authorization in kernel-mode drivers. This flaw allows an authorized local attacker to disclose sensitive information. The issue affects multiple builds of Windows 11 24H2 prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.
CVE-2026-105720 is an incorrect authorization vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to elevate privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. Microsoft has released an official fix in version 16.0.20326.20190. The vulnerability has a medium severity rating with a CVSS score of 4.3 and does not require user interaction for exploitation.
CVE-2026-102865 is an incorrect authorization vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to disclose information over a network without proper authorization. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. A fix is available in version 16.0.20326.20190. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-102862 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving incorrect authorization. It allows an authorized attacker to elevate privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. Microsoft has released an official fix in version 16.0.20326.20190.
CVE-2026-102232 is an incorrect authorization vulnerability in Microsoft Visual Studio Code that allows a local unauthorized attacker to bypass a security feature. The flaw affects versions from 1.0.0 up to but not including 1.141.1. Microsoft has released an official fix in version 1.141.1. The vulnerability has a high severity rating with a CVSS score of 7. Exploitation requires local access and high attack complexity, with no privileges required but user interaction needed. No known exploits are reported in the wild.
CVE-2026-92910 is an Incorrect Authorization vulnerability in Adobe Commerce that allows an attacker to bypass security features and gain unauthorized read and limited write access without requiring user interaction. The vulnerability changes the security scope and has a high severity rating.
Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized read and write access. This can cause limited disruption to availability. Exploitation does not require user interaction. The vulnerability is rated high severity with a CVSS score of 8.3.
Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code in the context of the current user without requiring any user interaction. This vulnerability has a critical severity with a CVSS score of 9.8.
CVE-2026-15577 is a medium severity vulnerability in Grafana Enterprise where a user or service account with read-only access to Git Sync provisioning connections can improperly modify a connection's configuration via its status subresource due to incorrect authorization. This issue affects specific versions of Grafana Enterprise when the experimental provisioning feature toggle is enabled. The vulnerability has a CVSS score of 6.5 and does not impact confidentiality or availability but allows integrity modification. No known exploits are reported, and no official patch links are provided.
CVE-2026-93294 is a vulnerability in Grafana Enterprise where a user with query access to an Azure Monitor data source can misuse the resource proxy to call Azure Resource Manager APIs beyond intended scope using the data source's Azure identity. The impact depends on the Azure role assigned to that identity. A patch is available to address this issue.