Windows Media Photo Codec Information Disclosure Vulnerability

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

Infinite loop on invalid input in golang.org/x/text

Windows Network File System Elevation of Privilege Vulnerability

Windows Network File System Remote Code Execution Vulnerability

Windows NFS Server Elevation of Privilege Vulnerability

Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

DirectX Graphics Kernel Elevation of Privilege Vulnerability

DirectX Graphics Kernel Elevation of Privilege Vulnerability

Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

NGINX ngx_http_ssi_module vulnerability

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.