Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
CVE-2026-62909
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
#cwe-248
共收录 198 条相关情报。
← 返回所有主题Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditiona...
CVE-2026-73088
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to
Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user combined with a high...
CVE-2026-20775
Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System softw
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
CVE-2026-13697
### Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection hand...
CVE-2026-52856
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65834
### Summary `CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never v
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
CVE-2026-52856
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
CVE-2026-52856
### Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec...
CVE-2026-65834
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMet
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65834
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMet
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degener...
CVE-2026-13697
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 an
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remot...
CVE-2026-47219
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and w
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization eng
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
CVE-2026-14631
### Impact An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
CVE-2026-59875
## Summary `node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image ...
CVE-2026-64612
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without inst
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can se...
CVE-2026-63747
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is
SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted H...
CVE-2025-71391
SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
CVE-2026-53496
## Summary ExifReader 4.40.0 can throw an uncaught `RangeError: Offset is outside the bounds of the DataView` while par
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured wi...
CVE-2026-62994
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreD