Month: May 2026

Improper access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-40420 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability→

Loop with unreachable exit condition (‘infinite loop’) in ASP.NET Core allows an unauthorized attacker to deny service over a network. Continue reading CVE-2026-42899 ASP.NET Core Denial of Service Vulnerability→

Heap-based buffer overflow in Windows Win32K – GRFX allows an authorized attacker to execute code locally. Continue reading CVE-2026-40403 Windows Graphics Component Remote Code Execution Vulnerability→

Improper control of generation of code (‘code injection’) in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. Continue reading CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability→

Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. Continue reading CVE-2026-32209 Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability→

Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-42896 Windows DWM Core Library Elevation of Privilege Vulnerability→

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. Continue reading CVE-2026-40370 SQL Server Remote Code Execution Vulnerability→

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. Continue reading CVE-2026-41614 M365 Copilot for Desktop Spoofing Vulnerability→