CVE-2026-69845 is a critical heap-based buffer overflow vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and earlier Windows versions. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction or privileges. Microsoft has released official fixes for all affected versions.
CVE-2026-69295 is a high-severity vulnerability in the Windows USB Driver affecting multiple Windows 10 versions including Version 1607. It allows a locally authorized attacker to perform an out-of-bounds read, which can lead to privilege escalation. The issue has been officially fixed in specific Windows updates.
CVE-2026-69286 is an out-of-bounds read vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating and has been officially fixed in several Windows 10 builds.
CVE-2026-69270 is a heap-based buffer overflow vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.
CVE-2026-68839 is a critical heap-based buffer overflow vulnerability in the Windows USB Mass Storage Class Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction or privileges. Microsoft has released official fixes for all affected versions.
CVE-2026-78518 is a high-severity out-of-bounds read vulnerability in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code remotely over a network. Multiple versions prior to fixed releases are affected. An official fix is available from Microsoft.
CVE-2026-69293 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and later versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Official patches have been released to address this issue in multiple Windows 10 builds.
CVE-2026-84282 is a Server-Side Request Forgery (SSRF) vulnerability in the ONLYOFFICE ownCloud Integration plugin version 9.12. It occurs because the /apps/onlyoffice/ajax/settings/address endpoint does not properly validate the Document Server URL provided by an authenticated administrator. This flaw allows the ownCloud server to send arbitrary requests to attacker-controlled destinations, including internal network hosts, enabling internal network reconnaissance and TCP port scanning.
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.
CVE-2025-52651 is an improper input validation vulnerability in HCL Software MyXalytics. This flaw allows malicious or unexpected input to cause unintended system behavior or security issues. The vulnerability has a low severity rating with a CVSS score of 3.5. No affected versions or patches are explicitly stated in the available data.
Note Mark, an open-source note-taking application, had an improper input validation vulnerability prior to version 0.19.5. The application validated book and note slug values using an unanchored regular expression, allowing malicious slugs containing directory traversal sequences (e.g., ../../../../../../tmp/escape). During data export, these unsanitized slugs were used to create directories and files outside the intended export path, potentially allowing arbitrary file creation with root privileges. This vulnerability has been fixed in version 0.19.5.
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because poll_next_raw (src/archive.rs) threads the buffered PAX records into the size computation of whatever raw header it reads next — and that header can be an intermediary L — the stream cursor is advanced by an attacker-chosen amount when the L body is consumed. The parser then desyncs relative to a POSIX-correct tar parser (e.g. GNU tar), reading subsequent bytes at the wrong block boundary. This issue has been patched in version 0.6.1.
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation.
Ash.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs.
This issue affects ash: from 2.16.1 before 3.32.2.
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute.
Ash.Type.UUIDv7.cast_input/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a 16-byte binary. On read, cast_stored/2 (lib/ash/type/uuid_v7.ex) routes the stored binary back through cast_input/2, which since an input-validation tightening in v3.6.3 matches only version-7 (and optionally version-4) 16-byte binaries and otherwise expects a 36-character string. A stored non-v7 16-byte binary matches neither clause and returns :error, so every later read of that record fails. An attacker able to set such an attribute poisons the row permanently. The fix decodes any 16-byte stored binary directly in cast_stored/2.
This issue affects ash: from 3.6.3 before 3.32.2.
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.
AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts "" for a required argument.
Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
CVE-2026-83492 is an improper input validation vulnerability in Extend Themes Kubio AI Website Builder affecting versions before 2.9.1. The flaw relates to CWE-20, indicating that the software does not properly validate input data. The vulnerability has a CVSS 4.0 base score of 6.9, categorized as medium severity. No official patch or remediation guidance is currently available, and there are no known exploits in the wild. The product is not a cloud service, so remediation depends on vendor updates. No affected versions were explicitly stated beyond the indication that versions before 2.9.1 are impacted.
CVE-2026-81633 is an improper input validation vulnerability in ash-project's ash_graphql component. An unauthenticated client can send a specially crafted relay node query that triggers an unhandled KeyError, causing the resolver to crash and potentially exposing a stacktrace. This occurs because the type segment of a decoded global ID is not validated before being used as a key in a map fetch operation. The issue affects versions from 0.27.0 up to but not including 1.11.0.
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
CVE-2026-59322 is a medium severity vulnerability in Spring Integration where the EmbeddedHeadersJsonMessageMapper deserializes JSON headers into a Map without sanitizing or filtering untrusted header names by default. This improper input validation can lead to the creation of GenericMessage objects with mutable headers that may be manipulated. The issue affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. No official patch or remediation level has been confirmed yet.