CVE-2026-110215

youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Youlai

Products

Youlai-boot

CVE-2026-66822

.NET Information Disclosure Vulnerability

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-69651

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-87697

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-70174

.NET Remote Code Execution Vulnerability

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-70197

.NET and Visual Studio Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net 10.0 Installed On Linux .net 10.0 Installed On Mac Os and 16 more

CVE-2026-70194

.NET Framework Security Feature Bypass Vulnerability

Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96224

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-70007

.NET Framework Remote Code Execution Vulnerability

Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-70035

.NET Framework Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-84008

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 3 more

CVE-2026-96231

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96225

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96229

.NET Information Disclosure Vulnerability

Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96238

.NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96957

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 5 more

CVE-2026-58280

.NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-102869

.NET and Visual Studio Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-103553

Windows Partition Management Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-96113

Windows Domain Name Service Remote Code Execution Vulnerability

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more