Podatności

The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting…

CVSS 6,7 · EPSS 1,68 % · rekomendacja wg zapisanej polityki

Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

CVSS 7,0 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

CVSS 7,0 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body…

CVSS 6,9 · EPSS 0,67 % · rekomendacja wg zapisanej polityki

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple…

CVSS 7,0 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that…

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in…

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a…

CVSS 7,0 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic…

CVSS 7,0 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that…

CVSS 7,0 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern…

CVSS 6,9 · EPSS 0,62 % · rekomendacja wg zapisanej polityki

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki