cve.bz

New CVEs this week, the last 7 days, newest first, page 52

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. –CVE-2026-126132EPSS 0.2%

    When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the …

  2. 9.4CVE-2026-126087EPSS 0.8%

    Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user wi…

  3. 7.4CVE-2026-125336EPSS 0.2%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validatin…

  4. 3.7CVE-2026-125335EPSS 0.2%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical en…

  5. 5.9CVE-2026-125334EPSS 0.3%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including aft…

  6. 5.9CVE-2026-125333EPSS 0.6%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie …

  7. 5.9CVE-2026-125332EPSS 0.4%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHel…

  8. 9.1CVE-2026-125331EPSS 0.3%

    HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to re…

  9. 7.5CVE-2026-125330EPSS 0.3%

    HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default…

  10. 8.4CVE-2026-125329EPSS 0.3%

    Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspac…

  11. 5.8CVE-2026-125328EPSS 0.3%

    pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHe…

  12. 7.5CVE-2026-125327EPSS 0.4%

    pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered…

  13. 7.8CVE-2026-125137EPSS 0.3%

    Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  14. 8.8CVE-2026-125136EPSS 0.5%

    Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network.

  15. 6.8CVE-2026-125135EPSS 0.3%

    Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

  16. 7.5CVE-2026-125134EPSS 0.4%

    Use after free in Windows Function Discovery Resource Publication allows an unauthorized attacker to execute code over an adjacent network.

  17. 6.5CVE-2026-124233EPSS 0.7%

    Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

  18. 6.6CVE-2026-124229EPSS 1.9%

    Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.

  19. 8.8CVE-2026-124228EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to execute code over a network.

  20. 7.5CVE-2026-124227EPSS 0.5%

    Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  21. 8.8CVE-2026-124226EPSS 0.3%

    Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

  22. 7.8CVE-2026-124225EPSS 0.4%

    Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.

  23. 7.0CVE-2026-124224EPSS 0.2%

    Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.

  24. 6.5CVE-2026-124210EPSS 0.6%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  25. 6.5CVE-2026-124194KEVEPSS 1.6%

    Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

  26. 8.8CVE-2026-124187EPSS 0.8%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  27. 7.5CVE-2026-124185EPSS 0.6%

    Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  28. 6.5CVE-2026-124183EPSS 0.9%

    Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  29. 6.5CVE-2026-124179EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  30. 6.5CVE-2026-124178EPSS 0.7%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  31. 8.8CVE-2026-124176EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  32. 8.8CVE-2026-124174EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  33. 7.5CVE-2026-124170EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  34. 5.9CVE-2026-123395EPSS 0.4%

    Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally.

  35. 8.8CVE-2026-123394EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  36. 8.8CVE-2026-123391EPSS 0.8%

    Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  37. 8.8CVE-2026-123390EPSS 1.7%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  38. 7.0CVE-2026-123389EPSS 0.3%

    Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

  39. 7.8CVE-2026-123388EPSS 0.3%

    Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

  40. 8.0CVE-2026-123387EPSS 0.8%

    Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.

  41. 8.8CVE-2026-123385EPSS 0.6%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  42. 8.8CVE-2026-123384EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  43. 8.8CVE-2026-123383EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  44. 8.8CVE-2026-123382EPSS 0.6%

    Untrusted pointer dereference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  45. 8.8CVE-2026-123381EPSS 0.6%

    Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  46. 8.8CVE-2026-123380EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  47. 7.5CVE-2026-123379EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  48. 7.5CVE-2026-123378EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  49. 8.8CVE-2026-123377EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  50. 8.8CVE-2026-123376EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.