CVEs

DHCP Server Service Denial of Service Vulnerability

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Winlogon Elevation of Privilege Vulnerability

Winlogon Elevation of Privilege Vulnerability

Windows Themes Denial of Service Vulnerability

Windows Distributed File System (DFS) Remote Code Execution Vulnerability

Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge for iOS Spoofing Vulnerability

Visual Studio Remote Code Execution Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally.

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize() in src/Filters/Block.php. By crafting that value, an unauthenticated attacker can smuggle a

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2026-46409. Reason: This record is a reservation duplicate of CVE-2026-46409. Notes: All CVE users should reference CVE-2026-46409 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.