Security Vulnerabilities
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.008
Published
2026-10-13
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
CVSS Score
9.8
EPSS Score
0.01
Published
2026-10-13
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.0
EPSS Score
0.003
Published
2026-10-13
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.0
EPSS Score
0.003
Published
2026-10-13
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.0
EPSS Score
0.003
Published
2026-10-13
CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Known exploited
CVSS Score
8.6
EPSS Score
0.26
Published
2026-10-13
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.
CVSS Score
7.1
EPSS Score
0.003
Published
2026-10-13
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.
CVSS Score
6.0
EPSS Score
0.003
Published
2026-10-13
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input.
CVSS Score
6.0
EPSS Score
0.003
Published
2026-10-13
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope, due to incorrect authorization of the import target namespace.
CVSS Score
3.1
EPSS Score
0.002
Published
2026-10-13