CVE-2026-83728
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.
CVSS
8.8
Alta
EPSS
0.3%
p23
KEV
—
Exploit Today
7
0-100
Publicado: 13 de out. de 2026 · Última mod.: 29 de out. de 2026 · CWE-1286
0.2%EPSS · 30 dias0.3%
2026-10-142026-11-06
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-48179—3.4%
——1In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service9hCVE-2026-33958—4.2%
——1Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.9hCVE-2026-205956.7 MÉD1.2%
——0In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.4dCVE-2026-111107—29.4%
——9A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.2dCVE-2026-1106758.1 ALT39.6%
——12Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.
With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.
Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.9dCVE-2026-1107599.8 CRÍ35.2%
——11Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.
A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.17d