CVE-2026-88132

Azure Key Vault Information Disclosure Vulnerability

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Keyvault Administration Azure Keyvault Certificates Azure Keyvault Keys and 1 more

CVE-2026-70213

Microsoft Power Apps Remote Code Execution Vulnerability

Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Power-apps Power Apps For Android

CVE-2026-105592

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office 2021 Office 2024

CVE-2026-105591

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office 2021 Office 2024

CVE-2026-102867

Microsoft Office Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office 2021 Office 2024

CVE-2026-102865

Microsoft Office SharePoint Information Disclosure Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-102863

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-102860

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-102858

Microsoft Office OneNote Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft 365 Office 2021 Office 2024 and 3 more

CVE-2026-102232

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-102229

Visual Studio Code Information Disclosure Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-103572

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-102850

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office 2021 Office 2024

CVE-2026-102849

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2021 and 3 more

CVE-2026-108798

ZKTeco BioTime hard-coded key

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zkteco

Products

Biotime

CVE-2026-108794

ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zkteco

Products

Biotime

CVE-2026-97767

Microsoft Office Excel Remote Code Execution Vulnerability

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 11 more

CVE-2026-108797

ZKTeco BioTime Employee REST API employees authorization

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zkteco

Products

Biotime

CVE-2026-108796

ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zkteco

Products

Biotime

CVE-2026-108795

ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zkteco

Products

Biotime