CVE Vulnerability Catalog

A vulnerability in Windows Push Notifications allows an authorized attacker to disclose sensitive information to an unauthorized actor locally.

A vulnerability in Windows Hyper-V allows an authorized attacker to disclose sensitive information locally. This issue involves the exposure of sensitive data to an unauthorized actor.

A vulnerability in Windows Push Notifications allows an authorized attacker to disclose sensitive information to an unauthorized actor locally.

A vulnerability in Windows Push Notifications allows an authorized attacker to disclose sensitive information to an unauthorized actor locally.

Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.

An out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.

Incorrect calculation of buffer size in Windows VMSwitch allows an authorized attacker to locally deny service.

An out-of-bounds read vulnerability in Windows Kerberos allows an authorized attacker to cause a denial of service over the network.

A vulnerability in Windows Shell allows an unauthorized actor to disclose sensitive information over the network. The attacker must be authenticated to exploit this flaw.

A vulnerability in Windows Shell allows an authorized attacker to disclose sensitive information locally.

A null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network.

CVE-2026-42771 concerns the X509_VERIFY_PARAM_set1_email function, which may lead to an out of bounds read when validating an email address. This can result in application crashes and denial of service.

An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level.

An attacker-controlled CMP server could trigger a NULL pointer dereference in a CMP client application, leading to application crashes.

A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption, leading to an application crash.

Svelte is a performance-oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties were included in the rendered HTML. This allowed attackers to inject malicious event handlers that could execute in victims' browsers.

Svelte prior to version 5.55.7 is vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.

A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path.

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser.