CVE Vulnerability Catalog

A vulnerability in Windows Shell allows an unauthorized actor to disclose sensitive information over the network. The attacker must be authenticated to exploit this flaw.

A vulnerability in Windows Shell allows an authorized attacker to disclose sensitive information locally.

A null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network.

CVE-2026-42771 concerns the X509_VERIFY_PARAM_set1_email function, which may lead to an out of bounds read when validating an email address. This can result in application crashes and denial of service.

An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level.

An attacker-controlled CMP server could trigger a NULL pointer dereference in a CMP client application, leading to application crashes.

A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption, leading to an application crash.

Svelte is a performance-oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties were included in the rendered HTML. This allowed attackers to inject malicious event handlers that could execute in victims' browsers.

Svelte prior to version 5.55.7 is vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.

A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path.

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser.

A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to inject malicious script into a web page. The attack can be performed remotely over a network.

A vulnerability that allows an attacker to provide a crafted external URL that may redirect a user to an unintended website.

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality.

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

A vulnerability in NETGEAR devices related to insufficient input validation allows authenticated administrators on the local network to tamper with the router's integrity.

An insufficient input validation vulnerability in certain NETGEAR router models allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions. This can result in unauthorized modification of protected router software or functionality.

CVE-2026-0415 describes an insufficient input validation vulnerability in the listed NETGEAR models, allowing authenticated administrators connected to the local network to make unauthorized modifications to router software and functionality.

CVE-2026-0414 describes an insufficient input validation vulnerability in the listed NETGEAR models, allowing authenticated administrators connected to the local network to make unauthorized modifications to router software and functionality.