CVE-2026-9067

Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Structured-data-for-wp Wordpress

Products

Download Schema \& Structured Data For Wp \& Amp Wordpress

CVE-2026-39169

Unauthorized Access via SEMCMS_copy.php in SEMCMS 5.0

SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sem-cms

Products

Semcms

CVE-2026-39170

Cross‑Site Request Forgery via Crafted POST to Admin Endpoint in SemCms 5.0

SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sem-cms

Products

Semcms

CVE-2026-50508

Windows NTLM Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS 11.4% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 11 22h2 Windows 11 22h2 and 9 more

CVE-2026-45647

Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Defender For Endpoint

CVE-2026-44803

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Excel Powerpoint Windows 10 1607 and 26 more

CVE-2026-44812

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Excel Powerpoint Windows 10 1607 and 26 more

CVE-2026-41116

Improper Link Resolution Allows Arbitrary File Write in Dell Inventory Collector Client

Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Inventory Collector

CVE-2026-40639

Weak Password Encoding in Dell BIOS Enables Privilege Escalation

Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Dell Precision 3630 Tower Edge Gateway 3000 Edge Gateway 5000 and 8 more

CVE-2026-45583

Microsoft Exchange Server Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-45649

Office for Android Spoofing Vulnerability

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Excel Excel For Android Powerpoint and 3 more

CVE-2026-32193

Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Kubernetes Service

CVE-2026-49161

Microsoft PC Manager Security Feature Bypass Vulnerability

Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Pc Manager

CVE-2026-40371

Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365 Dynamics 365 Server

CVE-2026-47293

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 2 more

CVE-2026-4821

Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it was published in error.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Github

Products

Enterprise Server

CVE-2026-11434

FluentCMS Blocks Plugin blocks cross site scripting

A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Blocks Plugin. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fluentcms

Products

Fluentcms

CVE-2026-44750

Missing Authorization check in SAP MDG (Review Match Groups Application)

SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. This could allow a low-privileged user to perform actions that would otherwise be restricted, resulting in escalation of privileges. This has a low impact on integrity, while confidentiality and availability are not impacted.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Mdg (review Match Groups Application)

CVE-2026-44751

Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver And Abap Platform

CVE-2026-11640

chromium-browser: Integer overflow in libyuv

Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more