Common Vulnerabilities and Exposures (CVE)

CVE-2026-40516

Apr 17, 2026 16:27:11 UTC

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper ...

CVE-2026-3464

Apr 17, 2026 16:26:50 UTC

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for ...

CVE-2026-4775

Apr 17, 2026 16:20:28 UTC

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds hea...

CVE-2026-33119

Apr 17, 2026 16:13:36 UTC

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-33118

Apr 17, 2026 16:13:35 UTC

Microsoft Edge (Chromium-based) Spoofing Vulnerability

CVE-2026-32214

Apr 17, 2026 16:13:35 UTC

Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

CVE-2026-33829

Apr 17, 2026 16:13:34 UTC

Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-33824

Apr 17, 2026 16:13:34 UTC

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

CVE-2026-33827

Apr 17, 2026 16:13:33 UTC

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

CVE-2026-33115

Apr 17, 2026 16:13:32 UTC

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-33114

Apr 17, 2026 16:13:32 UTC

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-33104

Apr 17, 2026 16:13:31 UTC

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVE-2026-33103

Apr 17, 2026 16:13:31 UTC

Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.

CVE-2026-33101

Apr 17, 2026 16:13:30 UTC

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

CVE-2026-33100

Apr 17, 2026 16:13:29 UTC

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.