Opinions, tips, and news orbiting Microsoft
Improper limitation of a pathname to a restricted directory (‘path traversal’) in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Continue reading CVE-2026-45454 Microsoft SharePoint Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network. Continue reading CVE-2026-42974 Windows Performance Monitor Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. Continue reading CVE-2026-44822 Microsoft Excel Information Disclosure Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-42984 Windows Kernel Elevation of Privilege Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. Continue reading CVE-2026-40376 Visual Studio Code Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. Continue reading CVE-2026-42970 Windows Push Notification Information Disclosure Vulnerability
Improper neutralization of special elements in output used by a downstream component (‘injection’) in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. Continue reading CVE-2026-42835 Microsoft Teams for Android Information Disclosure Vulnerability
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. Continue reading CVE-2026-42969 Windows Push Notification Information Disclosure Vulnerability