•about 14 hours ago•CVE-2026-62898
7.5CVE-2026-62898: Use After Free Information Disclosure in Microsoft QUIC
A critical use-after-free vulnerability in Microsoft QUIC allows unauthenticated remote attackers to disclose sensitive system memory over the network. The vulnerability is caused by a race condition during rapid connection termination and asynchronous packet retransmission.
10 views•6 min read
•about 15 hours ago•CVE-2026-62899
5.9CVE-2026-62899: .NET Security Feature Bypass Vulnerability (HTTP Request Smuggling)
CVE-2026-62899 is a security feature bypass vulnerability in the Microsoft .NET runtime environment on non-Windows platforms. The flaw manifests as an HTTP Request/Response Smuggling vulnerability (CWE-444) within the managed implementation of the System.Net.HttpListener class. This allows unauthenticated remote attackers to desynchronize request boundaries when the backend .NET application is hosted behind an upstream reverse proxy.
15 views•6 min read
•about 16 hours ago•CVE-2026-62901
7.5CVE-2026-62901: Remote Denial of Service via Infinite Loop in .NET WebSockets Engine
CVE-2026-62901 is a high-severity Denial of Service (DoS) vulnerability in the Microsoft .NET ecosystem, specifically affecting the System.Net.WebSockets frame-processing engine and associated network transports. Under certain circumstances, a remote, unauthenticated attacker can exploit this vulnerability by sending malformed or specifically crafted WebSocket packets over the network, causing a targeted .NET application server to enter a tight infinite loop. This behavior results in 100% CPU utilization on the executing thread, starving application resources and leading to a complete Denial of Service.
13 views•6 min read
•about 17 hours ago•CVE-2026-62909
7.8CVE-2026-62909: .NET Local Elevation of Privilege via Unchecked Diagnostic Socket Permissions
A high-severity Local Elevation of Privilege (EoP) vulnerability exists in the Microsoft .NET runtime and Visual Studio on Unix-like platforms. The flaw arises from an unchecked return value (CWE-252) during the initialization of the Diagnostics Inter-Process Communication (IPC) socket. By exploiting this vulnerability, a low-privileged local attacker can execute arbitrary commands with the privileges of a higher-privileged .NET process.
20 views•6 min read
•about 18 hours ago•CVE-2026-70354
7.8CVE-2026-70354: Out-of-Bounds Write in .NET Windows Presentation Foundation Subsystem
CVE-2026-70354 is a high-severity local code execution vulnerability affecting multiple versions of the Microsoft .NET runtime, .NET Framework, and Microsoft Visual Studio. The vulnerability is located within the Windows Presentation Foundation (WPF) layout and rendering subsystems, specifically within the parsing and rasterization of complex graphical layouts, XPS files, or custom font structures.
17 views•7 min read
•about 20 hours ago•CVE-2026-62897
7.0CVE-2026-62897: Integer Overflow and Code Execution in .NET WPF and WinForms
An integer overflow vulnerability (CWE-190) exists in the layout and rendering engines of the Microsoft .NET Framework and .NET Core. This flaw resides within the processing of complex coordinate maps, font tables, and image metadata in Windows Presentation Foundation (WPF) and Windows Forms (WinForms). By convincing a user to open a crafted vector graphic or layout document, a local attacker can exploit this arithmetic error to induce an undersized memory allocation, leading to a heap-based buffer overflow and subsequent arbitrary code execution within the context of the vulnerable application.
11 views•6 min read
•about 21 hours ago•CVE-2026-62871
7.8CVE-2026-62871: Local Code Execution and Elevation of Privilege in .NET and Visual Studio
CVE-2026-62871 is a high-severity local code execution and elevation of privilege vulnerability in Microsoft .NET and Microsoft Visual Studio. It arises from an out-of-bounds write (heap-based buffer overflow) in the runtime environment during native interoperability or unmanaged pointer manipulation, requiring user interaction to execute arbitrary instructions.
18 views•7 min read
•about 22 hours ago•CVE-2026-62902
6.5CVE-2026-62902: .NET and Visual Studio Information Disclosure Vulnerability
An information disclosure vulnerability in Microsoft .NET and Microsoft Visual Studio allows an unauthorized remote attacker to trigger outbound network requests (SSRF) and disclose sensitive environment data by leveraging untrusted inputs and user interaction.
12 views•7 min read
•about 22 hours ago•CVE-2026-62886
7.8CVE-2026-62886: .NET Elevation of Privilege Vulnerability via Native Heap Buffer Overflow
An integer overflow or wraparound vulnerability (CWE-190) in the native layer of the .NET runtime allows local unauthenticated attackers to corrupt the native heap, leading to a heap-based buffer overflow (CWE-122) and local privilege escalation.
15 views•5 min read
•1 day ago•CVE-2026-73080
9.3CVE-2026-73080: Unauthenticated Server-Side Request Forgery (SSRF) in SeaweedFS Volume Server
A critical-severity Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS volume servers prior to version 4.24. Unauthenticated attackers can trigger arbitrary HTTP requests to internal networks and cloud metadata services via the gRPC endpoint and retrieve the response data.
12 views•6 min read
•4 days ago•CVE-2026-71556
7.1CVE-2026-71556: Symbolic Link Directory Traversal in go-git
A symbolic link directory traversal vulnerability was identified in go-git, a pure Go implementation of the Git specification. This vulnerability allows an attacker to construct a repository that, when checked out or processed, bypasses directory boundaries to write or overwrite arbitrary files on the host filesystem.
19 views•5 min read
•4 days ago•CVE-2026-71557
6.3CVE-2026-71557: Path Traversal and Configuration Overwrite in go-git Filesystem Storage Engine
CVE-2026-71557 is a path traversal vulnerability in go-git, a pure-Go implementation of Git. In vulnerable versions, the filesystem-backed storage engine fails to validate reference names before mapping them to on-disk paths. An attacker hosting a malicious Git server can advertise references containing directory traversal sequences, such as 'refs/heads/../../config', to write or overwrite files outside the intended reference storage directory.
12 views•7 min read