CVE-2026-70177 is a numeric truncation error vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-70126 is an out-of-bounds read vulnerability in the Windows Bluetooth Port Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw could allow an unauthorized attacker to execute code over an adjacent network. The vulnerability has a high severity rating and has been officially fixed by Microsoft in specific updates.
CVE-2026-105719 is an improper input validation vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to disclose information over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A fix is available in version 16.0.20326.20190. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-105718 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has issued official fixes for this vulnerability in multiple versions of the software.
CVE-2026-105717 is a heap-based buffer overflow vulnerability in Microsoft Office Access within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects specific versions prior to 16.0.14334.20974 and 16.0.17932.21056, with official fixes available. The CVSS score of 8.8 indicates a high severity level, reflecting the potential for complete confidentiality, integrity, and availability impact.
CVE-2026-102867 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Official patches have been released by Microsoft to address this issue.
CVE-2026-95631 is an improper input validation vulnerability in Adobe Commerce that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerability changes the security scope and could lead to significant impact on integrity and availability.
CVE-2026-92464 is an improper input validation vulnerability in Adobe Commerce that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerability affects the context of the current user and changes the security scope. It is rated critical with a CVSS score of 9.1.
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
ConnectBot SSH Client Library versions prior to 0.3.1 contain an improper input validation vulnerability in the SSH protocol parser. The parser trusts attacker-controlled inner byte lengths and element counts without verifying they fit within the containing packet. This can cause excessive memory allocation attempts leading to an uncaught OutOfMemoryError, terminating the application process. There is no demonstrated impact on confidentiality or integrity. The issue is fixed in version 0.3.1.
CVE-2026-107918 is an insufficient input validation vulnerability in the LAN Setup feature of the NETGEAR R7300DST router. It allows authenticated administrators on the local network to perform unauthorized actions on the router. This issue was discovered in a simulated environment and has not been confirmed on physical production devices. The vulnerability has a medium severity rating with a CVSS 4.3 score. No patch or official remediation information is currently available.
CVE-2026-107917 is an input validation vulnerability in the PPPoE Setup feature of the NETGEAR R7300DST router. It allows authenticated administrators on the local network to perform unauthorized actions. The issue was identified in a simulated environment and has not been confirmed on physical devices. The vulnerability affects firmware versions from 0 up to and including 1.0.0.74. The CVSS 4.0 score is 4.3, indicating a medium severity level.
CVE-2026-11732 is an input validation vulnerability in the website blocking feature of the NETGEAR CAX30 router. A network-adjacent attacker with network access, such as WiFi credentials, can exploit this flaw to run unauthorized commands on the router. This vulnerability impacts confidentiality, integrity, and availability but only when the Block Sites feature is enabled. The issue affects multiple versions prior to specific fixed releases. The CVSS 4.0 score rates this as a medium severity vulnerability.
CVE-2026-9218 is an improper input validation vulnerability in the time server (NTP) setting of the NETGEAR CBR40 router. An attacker with local network access and administrator credentials can run unauthorized commands on the router, impacting its integrity. There is no impact on confidentiality or availability. The vulnerability has a medium severity score of 4.3 and affects multiple firmware versions prior to certain fixed releases.
CVE-2026-84316 is an improper input validation vulnerability in 0xJacky's nginx-ui that allows authenticated users to bypass directive validation by placing blocked directives after a semicolon on the same line. This bypass affects all guarded write paths that call the validator, enabling injection of dangerous nginx directives such as js_import, load_module, and user root. On deployments with njs or perl modules enabled, this leads to code execution in the nginx worker process, potentially as root. The vulnerability requires authentication via node secret or user JWT and has been demonstrated on version 2.3.11 of the official Docker image. The issue stems from the validator splitting config content by newlines and only inspecting the first token per line, while nginx parses multiple directives separated by semicolons on the same line.
CVE-2026-78673 is a high severity vulnerability in IBM Maximo AI Service versions 9.1.0 and 9.2.0. It involves improper input validation that could allow a remote attacker to cause a denial of service (DoS). No confidentiality or integrity impact is reported. There are no known exploits in the wild, and no patch information is provided.
CVE-2026-84317 is an improper input validation vulnerability in the 0xJacky nginx-ui product. The vulnerability arises because the MCP tool 'nginx_config_add' does not enforce validation on user-supplied nginx configuration content, unlike other config-write paths. This allows an authenticated user to inject dangerous nginx directives such as 'js_*', 'perl_*', 'load_module', and 'user root', potentially leading to nginx code execution with root privileges if the njs/perl modules are available. The issue is due to an incomplete hardening patch that missed adding validation to the 'nginx_config_add' path. A proof of concept demonstrates remote code execution via JavaScript in the nginx worker running as root. The vulnerability affects versions prior to 2.4.1 and has a CVSS 3.1 score of 8.8 (high severity).
CVE-2026-104364 is a vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. It involves improper input validation that could allow a local attacker to cause a denial of service. The vulnerability has a low severity rating and a CVSS score of 3.3. No information about patches or exploits in the wild is currently available.
CVE-2026-57143 is an improper input validation vulnerability in MervinPraison's praisonaiagents before version 1.6.62. The vulnerability involves the searxng_search and search_web SearxNG providers passing an LLM-controlled URL parameter directly to requests.get without validating its scheme, host, port, or resolved address. This allows prompt-injected content to access internal JSON services, probe internal ports, and attempt cloud metadata requests, with the results incorporated into the agent context. The issue is fixed in version 1.6.62.