CVE-2026-41104

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
May 22, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-411058.1Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.CVE-2026-411069.3Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.CVE-2026-411077.4External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a netwCVE-2026-411087.0Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-411098.8Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allowCVE-2026-41117.5A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processCVE-2026-411138.1sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.CVE-2026-41114Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 befoCVE-2026-411154.3An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API valCVE-2026-411166.3Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulneraCVE-2026-411196.8Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated CVE-2026-41127.2Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote
CVE-2026-41104: High severity, CVSS 7.5 | Vulnix