Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.

Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue. The name of the patch is 3b92dd64d5648f829968cf48bf67dc3113852fef. Upgrading the affected component is advised.