Security Vulnerabilities
Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.
CVSS Score
6.5
EPSS Score
0.001
Published
2026-01-13
Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.
CVSS Score
7.5
EPSS Score
0.001
Published
2026-01-13
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS Score
7.2
EPSS Score
0.001
Published
2026-01-13
Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.
CVSS Score
7.7
EPSS Score
0.001
Published
2026-01-13
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free.
Improper reference counting on an internal resource caused scenario where potential for use after free was present.
CVSS Score
7.8
EPSS Score
0.0
Published
2026-01-13
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
CVSS Score
7.2
EPSS Score
0.0
Published
2026-01-13
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.
CVSS Score
9.8
EPSS Score
0.0
Published
2026-01-13
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.
CVSS Score
3.8
EPSS Score
0.0
Published
2026-01-13
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.
Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.
CVSS Score
3.5
EPSS Score
0.0
Published
2026-01-13
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario.
Improper resource management and reference counting on an internal resource caused scenario where potential write use after free was present.
CVSS Score
8.8
EPSS Score
0.0
Published
2026-01-13