Apache Cocoon: Cross-user cache poisoning

** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

Windows Kernel Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

Microsoft Internet Messaging API Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.

Windows Search Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Windows Search Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Windows Direct Composition Elevation of Privilege Vulnerability

Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

HID Parser Library Elevation of Privilege Vulnerability

Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.

Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability

Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.

Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.

Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.

Servicing Stack Updates Elevation of Privilege Vulnerability

Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Windows Input System Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Windows Clipboard User Service Information Disclosure Vulnerability

Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally.

RPC Runtime Elevation of Privilege Vulnerability

Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.

RPC Runtime Information Disclosure Vulnerability

Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.

Windows Print Spooler Components Information Disclosure Vulnerability

Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Private channel ID disclosure via user status endpoints

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765