Opinions, tips, and news orbiting Microsoft
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. Continue reading CVE-2026-70334 Visual Studio Code Security Feature Bypass Vulnerability
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. Continue reading CVE-2026-66305 Skype for Business Spoofing Vulnerability
Improper neutralization of input during web page generation (‘cross-site scripting’) in Skype for Business allows an unauthorized attacker to perform spoofing over a network. Continue reading CVE-2026-63523 Skype for Business Spoofing Vulnerability
Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-69890 Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-69740 Windows Hello Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-83996 Windows Error Reporting Elevation of Privilege Vulnerability
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network. Continue reading CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. Continue reading CVE-2026-70290 Win32k Information Disclosure Vulnerability