cve 2026

Microsoft published CVE-2026-45502 on June 9, 2026, as a Microsoft Exchange Server information disclosure vulnerability in the MSRC Security Update Guide, assigning Microsoft as the CNA and presenting the issue as a confirmed security flaw affecting Exchange administrators’ patch queues. The...

Microsoft published CVE-2026-45591 on June 9, 2026, as an Important-rated ASP.NET Core denial-of-service vulnerability caused by uncontrolled resource consumption and affecting .NET 8.0, .NET 9.0, .NET 10.0, ASP.NET Core 8.0, 9.0, 10.0, and Visual Studio 2026 version 18.6. The exploitability...

Microsoft’s CVE-2026-45642 is a spoofing vulnerability disclosed for Microsoft Azure Attestation service and Device Health Attestation Service in the June 2026 Security Update Guide, affecting the trust signals Windows and Azure environments use to prove device or platform health. The flaw is...

Microsoft classifies CVE-2026-45486 as a Microsoft Word Remote Code Execution vulnerability even though its CVSS attack vector is Local because the exploit code runs on the victim’s machine after a malicious document or content path reaches the user, while the attacker may be remote from that...

On May 28, 2026, kernel.org assigned CVE-2026-46220 to an AMDGPU flaw in the Linux kernel’s SDMA 4.0 fence-emission path, where crafted unprivileged command submissions could hit BUG_ON() assertions and panic the system. The patch is small, but the lesson is not. This is not the story of an...

CVE-2026-45912 is a newly published Linux kernel ext4 vulnerability, received by NVD from kernel.org on May 27, 2026, involving stale extent-status caching during extent splitting that can lead to incorrect space accounting. It is not, at least from the public record so far, a...

The Linux kernel vulnerability now tracked as CVE-2026-46088 was published by NVD on May 27, 2026, after kernel.org assigned a flaw in ALSA’s control code involving snd_ctl_elem_init_enum_names() and a missing buffer-length guard before a fortified strnlen() call. The bug is not, on current...

Linux kernel maintainers have assigned CVE-2026-45841 to a netfilter flaw, published by NVD on May 27, 2026, in which a privileged CAP_NET_ADMIN user can load a malformed passive OS fingerprint that later causes a divide-by-zero panic when matching TCP SYN traffic. The bug is small, the patch is...

Microsoft patched CVE-2026-20841, a high-severity Windows 11 Notepad remote code execution vulnerability, in the February 2026 Patch Tuesday cycle, after researchers found that Markdown links could make the modern Notepad app launch unsafe protocol handlers and execute remote files under the...

Siemens Solid Edge SE2026 versions before V226.0 Update 5 are affected by two newly disclosed PAR file parsing vulnerabilities, published by Siemens ProductCERT on May 12, corrected in title metadata on May 13, and republished by CISA on May 14, 2026. The fix is straightforward: install Update 5...

Microsoft published CVE-2026-33112 on May 12, 2026, as a Microsoft SharePoint Server remote code execution vulnerability in its Security Update Guide, marking it as a confirmed server-side flaw for administrators to address in the May Patch Tuesday cycle. The dry wording matters because...

Microsoft published CVE-2026-41109 on May 12, 2026, as a GitHub Copilot and Visual Studio Code security feature bypass vulnerability, placing the issue in the developer workstation rather than the traditional Windows endpoint or server stack. That distinction matters because AI coding assistants...

CVE-2026-40360 is a Microsoft Excel information disclosure vulnerability published in Microsoft’s Security Update Guide on May 12, 2026, affecting Excel users who process untrusted workbooks and requiring administrators to evaluate Office updates through the same Patch Tuesday machinery used for...

Microsoft published CVE-2026-35440 on May 12, 2026, as a Microsoft Word information disclosure vulnerability in the Security Update Guide, placing it inside the May Patch Tuesday stream of Office fixes rather than a standalone emergency advisory. The interesting part is not that Word has another...

Microsoft has listed CVE-2026-35433 as a .NET elevation-of-privilege vulnerability in the Security Update Guide as of May 2026, with the public advisory offering the vulnerability title and scoring context but little technical detail about the underlying flaw. That thin disclosure is not unusual...

Microsoft published CVE-2026-35423 on May 12, 2026, as a Windows 11 Telnet Client information disclosure vulnerability, identifying the legacy optional client as the affected component and framing the issue as a confidentiality risk rather than code execution or privilege escalation. That...

CVE-2026-43298, published to the NVD on May 8, 2026, documents a Linux kernel amdgpu driver flaw in which AMDGPU’s VCN 2.5 virtual-function teardown path tried to release a poison interrupt that the VF never enabled. That sounds almost comically narrow, but it is exactly the kind of kernel...

CVE-2026-43299 is a newly published Linux kernel Btrfs vulnerability, disclosed through kernel.org and surfaced in NVD and Microsoft’s Security Update Guide on May 8, 2026, involving a crash when Btrfs flips a filesystem read-only during pending read-repair work. The flaw is not a flashy...

Microsoft disclosed on May 7, 2026, that two patched vulnerabilities in its Semantic Kernel agent framework could let prompt injection become remote code execution or arbitrary host file writes in affected Python and .NET agent deployments. The headline is not that a chatbot said something...

On May 6, 2026, CVE-2026-43119 was published for a Linux kernel Bluetooth flaw in hci_sync, where unsynchronized reads and writes of hdev->req_status could create a data race across separate kernel workqueues. The fix is small, almost boring: annotate the shared status field with READ_ONCE() and...