新着セキュリティニュース バックナンバー

CVE-2026-61348

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-61347

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.

CVE-2026-61346

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-61345

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

CVE-2026-59138

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

CVE-2026-59137

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

CVE-2026-59136

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

CVE-2026-59135

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

CVE-2026-59134

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-59133

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network.

CVE-2026-59132

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

CVE-2026-59131

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.

CVE-2026-59130

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.

CVE-2026-59128

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.

CVE-2026-59127

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-59126

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

CVE-2026-59125

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-59124

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

CVE-2026-59122

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVE-2026-59119

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

CVE-2026-59113

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-58651

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-58650

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-58641

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

CVE-2026-58639

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-58612

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

CVE-2026-57105

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-57104

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-56179

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.

CVE-2026-56174

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

CVE-2026-54984

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

CVE-2026-54981

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-54123

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.

CVE-2026-54113

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.

CVE-2026-50516

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-50472

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

CVE-2026-49179

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

CVE-2026-48483

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.

• security-advisories@github.com
• 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE-2026-48446

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVE-2026-48445

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48444

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48443

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48442

Threat Intelligence NVD CVE 危険度: high 緊急度: high

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-48440

Threat Intelligence NVD CVE 危険度: high 緊急度: high

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVE-2026-48439

Threat Intelligence NVD CVE 危険度: high 緊急度: high

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48438

Threat Intelligence NVD CVE 危険度: high 緊急度: high

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48437

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVE-2026-48436

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVE-2026-48435

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48434

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.