SAP Fiori App Intercompany Balance Reconciliation fails to enforce proper authorization controls, allowing authenticated users to escalate privileges and access or modify sensitive data they should not have permission to view. An attacker with valid credentials can exploit missing access checks to compromise the confidentiality and integrity of financial reconciliation data. No patch is currently available for this vulnerability.
Arbitrary code execution in Firefox and Thunderbird versions prior to 147/140.7 results from memory corruption vulnerabilities that could allow remote attackers to execute malicious code with no user interaction required. Multiple memory safety flaws across Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146 create conditions for potential exploitation despite no patch currently being available. The high CVSS score of 8.1 reflects the critical nature of achieving full system compromise through network-based attack vectors.
DOM security bypass in Firefox and Thunderbird allows remote attackers to circumvent protective mitigations through user interaction, affecting multiple versions across both products. An attacker can exploit this to achieve high-impact compromise of confidentiality and integrity without requiring authentication. Currently no patch is available for affected users.
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. [CVSS 8.1 HIGH]
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality. [CVSS 8.1 HIGH]
Authenticated attackers on the same network can execute arbitrary OS commands on NETGEAR Orbi routers (RBS860, RBR850, RBSE950) through improper validation of DHCPv6 input. The vulnerability requires local or WiFi network access but no user interaction, giving attackers full system compromise capabilities on affected devices. A patch is available for this high-severity flaw.
NETGEAR Orbi routers (RBS850, RBE970, RBS750) are vulnerable to OS command injection through inadequate input validation, enabling attackers on the local network to execute arbitrary commands with elevated privileges. The vulnerability requires LAN access and low privileges but provides complete system compromise through high-impact code execution capabilities. A patch is available for affected firmware versions.
NETGEAR WiFi extenders (Ex3110, Ex6110, Ex5000, Ex2800) contain an authentication bypass vulnerability that allows network-adjacent attackers with WiFi access or physical Ethernet connectivity to gain unauthorized admin panel access. An attacker can exploit insufficient authentication validation to fully compromise the device's confidentiality, integrity, and availability. A patch is available for affected firmware versions.
NETGEAR WiFi extenders (Ex5000, Ex6110, Ex2800, Ex3110) with improper path traversal validation allow authenticated LAN users to access the webproc configuration file and extract stored router credentials. An attacker with local network access can leverage this to obtain administrative credentials for further network compromise. A patch is available.
Privilege escalation in Windows 11 and Windows Server 2025 Capability Access Management Service results from a race condition in resource synchronization, enabling authenticated local users to gain elevated system privileges. The vulnerability affects multiple recent Windows versions (24h2 and 25h2) and currently lacks a patch. No public exploit code has been disclosed, though the attack requires local access and moderate complexity to execute.
NETGEAR XR1000v2 routers are vulnerable to OS command injection through inadequate input validation, enabling attackers with LAN access to execute arbitrary commands with elevated privileges. The vulnerability affects authenticated users on the local network and could allow complete router compromise including data interception and network manipulation. A patch is available.
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 7.0 HIGH]
Incorrect boundary condition validation in Firefox and Thunderbird's WebGL graphics component allows attackers to escape the sandbox and potentially execute arbitrary code through a crafted web page or malicious content. The vulnerability affects Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7, and requires user interaction to exploit. No patch is currently available.
Local privilege escalation in Windows Local Session Manager (LSM) across Windows 11 23h2, Windows Server 2012, and 2019 stems from improper synchronization in shared resource handling, enabling authenticated attackers to elevate privileges on affected systems. The vulnerability requires local access and specific timing conditions to exploit, with no patch currently available. This affects systems running the impacted Windows and Server editions where authenticated users may achieve system-level privileges.
Privilege escalation in Windows Server 2025 Capability Access Management Service stems from improper synchronization of shared resources, enabling authenticated local users to gain elevated privileges. The race condition requires specific timing conditions but no patch is currently available, leaving affected systems vulnerable to privilege escalation attacks by authorized local users.
Privilege escalation in Windows 11 and Windows Server 2025 Capability Access Management Service stems from improper synchronization of shared resources, enabling a local authenticated attacker to gain elevated privileges. The vulnerability exploits a race condition that can be triggered without user interaction, though successful exploitation requires specific timing and system conditions. No patch is currently available for this high-severity issue.
Local privilege escalation in Windows Win32K (ICOMP) via type confusion allows authenticated users to gain system-level access on Windows 11 and Windows Server 2025. The vulnerability affects multiple recent Windows versions with no available patch, requiring immediate mitigation strategies for at-risk environments. Exploitation requires local access but no user interaction, making it a significant risk for multi-user systems.
Windows 10 1607 is affected by access of resource using incompatible type (type confusion) (CVSS 7.8).
Local privilege-level buffer overflow in the Linux kernel's ethtool subsystem allows an attacker who can trigger a device stat-count change between the ETHTOOL_GSSET_INFO, ETHTOOL_GSTRINGS, and ETHTOOL_GSTATS ioctls to overflow a userspace stats buffer, corrupting memory and potentially escalating privileges. The flaw stems from a TOCTOU race where drivers using dynamic counters (mlx5, bnx2x, bna, ksz884x) can report a different stat count than the buffer sized by userspace. It is not in CISA KEV, EPSS exploitation probability is very low (0.06%), and no public exploit has been identified, though a vendor patch is available.
Local privilege escalation in Azure Connected Machine Agent exploits a stack-based buffer overflow, enabling authenticated users to gain elevated system privileges. The vulnerability affects Azure and Stack Overflow deployments and requires local access with valid credentials to exploit. No patch is currently available for this high-severity issue.
In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59!
In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device being brought down.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data.
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer.
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.
Local privilege escalation in the Linux kernel's ETS (net/sched) packet scheduler arises from a use-after-free on a struct Qdisc object, caused by a race between ets_qdisc_dequeue and ets_qdisc_change. When bands are reconfigured, a class can retain its entry on the active list after its child qdisc is freed and nulled, letting a concurrent dequeue operate on freed memory. Trend Micro ZDI reports a working reproducer and that an attacker able to create user and network namespaces can trigger the flaw and, per their analysis, control RIP; there is no CISA KEV listing and EPSS is very low (0.05%), so no public evidence of active exploitation.
Out-of-bounds memory access in the Linux kernel's dtv5100 DVB-USB media driver allows a local, low-privileged attacker to corrupt kernel memory via an unchecked, user-controlled rlen value in dtv5100_i2c_msg(). Because rlen is never validated against sizeof(st->data), a value larger than the buffer drives reads/writes past the allocated region, enabling denial of service and potential local privilege escalation. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and it is not listed in CISA KEV, but a vendor fix is available.
Local privilege escalation and kernel memory corruption in the Linux kernel's net/sched ETS (Enhanced Transmission Selection) qdisc allows a user with network-configuration capability to corrupt an internal linked list by toggling a scheduling class between DRR and strict modes. When an active DRR class is reconfigured to strict, ets_qdisc_change() fails to remove it from the active list, so switching it back to DRR performs a double list_add, corrupting kernel list pointers. No public exploit has been identified at time of analysis and the EPSS score is very low (0.05%), but the flaw is a classic kernel list-corruption primitive that can escalate to arbitrary write and full compromise.
Local privilege escalation risk in the Linux kernel's vidtv (Virtual Digital TV) media test driver stems from a double-free and use-after-free condition in vidtv_channel_si_init(), where local pointers are not reset to NULL after ownership of program/service/event list memory is transferred to the PAT/SDT/EIT tables. When vidtv_psi_pmt_create_sec_for_each_pat_entry() fails and control jumps to the free_eit error path, already-freed memory is destroyed a second time. Publicly this is patched upstream and shipped via Ubuntu USN-8096-1, but with EPSS at 0.05% and no public exploit identified at time of analysis, real-world exploitation is unlikely and confined to systems that actually load this virtual test driver.
Local privilege-holder-triggered use-after-free in the Linux kernel's mlxsw Spectrum switch driver (drivers/net/ethernet/mellanox/mlxsw) lets a network-admin operation on Nvidia/Mellanox Spectrum ASIC hardware dereference a freed neighbour object during RIF teardown. The driver cached a neighbour pointer without holding a reference, so freeing the neighbour (e.g. while removing a device from a VRF) leaves a dangling pointer that mlxsw_sp_neigh_entry_update() reads, corrupting kernel memory. CVSS is 7.8 (local, low privilege in the automated NVD scoring) but EPSS is only 0.05% (16th percentile) and there is no public exploit or CISA KEV listing - the flaw was found via an internal stress test, not observed attacks.
Local privilege escalation potential arising from a use-after-free in the Linux kernel's mlxsw Spectrum driver (spectrum_mr) allows an attacker with network-administration rights on a Mellanox Spectrum switch to trigger memory corruption during multicast route replacement. A prior fix introduced a dedicated mutex to protect the multicast route list, but one list-entry deletion path during route replace was missed, so the periodic mlxsw_sp_mr_stats_update worker can read a freed route object. EPSS is low (0.05%) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable branches.
Arbitrary code execution in Adobe Dreamweaver 21.6 and earlier stems from an incorrect authorization flaw that allows attackers to bypass security controls when a user opens a malicious file. An attacker can execute code with the privileges of the current user, potentially compromising the system. No patch is currently available for this vulnerability.
Arbitrary code execution in Substance 3D Stager 3.1.5 and earlier stems from a use-after-free vulnerability that executes with the privileges of the current user. An attacker can exploit this by crafting a malicious file that triggers the vulnerability when opened by a victim, requiring user interaction to activate the attack. No patch is currently available for this vulnerability.
Arbitrary code execution in Substance 3D Modeler 1.22.4 and earlier via out-of-bounds write vulnerability when processing malicious files. An attacker can execute code with the privileges of the user who opens a crafted file, requiring social engineering for successful exploitation. No patch is currently available for this vulnerability.
Arbitrary code execution in Substance 3D Modeler versions 1.22.4 and earlier results from an out-of-bounds write vulnerability triggered when users open malicious files. An attacker can leverage this to execute code with the privileges of the current user, with no patch currently available to remediate the issue.
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability triggered when users open specially crafted files. An attacker can leverage this to execute code with the privileges of the affected user, though exploitation requires social engineering to deliver the malicious file. No patch is currently available.
Arbitrary code execution in Substance 3D Sampler 5.1.0 and earlier through an out-of-bounds write vulnerability that requires a user to open a malicious file. An attacker can execute commands with the privileges of the current user on the affected system. No patch is currently available for this vulnerability.
Arbitrary code execution in Adobe Substance 3D Painter versions 11.0.3 and earlier through an out-of-bounds write flaw allows attackers to execute commands with user privileges when a victim opens a crafted file. The vulnerability requires user interaction but carries high impact potential across confidentiality, integrity, and availability. No patch is currently available for affected users.
Local privilege escalation in Windows Desktop Window Manager (DWM) through use-after-free memory corruption affects Windows 10 22H2, Windows Server 2022, and Windows Server 2025. An authenticated local attacker can exploit this vulnerability to gain system-level privileges with no user interaction required. No patch is currently available for this high-severity vulnerability.
Privilege escalation in Windows Task Host Process affects Windows 11 and Server 2025 through unsafe symbolic link handling, allowing authenticated local users to gain elevated system privileges. An attacker with standard user access can exploit improper link resolution to bypass access controls and execute arbitrary actions with SYSTEM-level permissions. Currently no patch is available for this vulnerability.
Unauthenticated administrative access in NETGEAR Orbi routers (CBR750, NBR750, RBE370, RBE371) allows local network attackers to bypass authentication and gain full admin control of the web interface. This high-severity vulnerability (CVSS 7.8) impacts all users on networks connected to affected devices, enabling attackers to modify router settings, potentially compromising network security and connected devices. A patch is available.
Windows Cloud Files Mini Filter Driver contains a heap-based buffer overflow that enables local privilege escalation on Windows 10 1809, Windows Server 2016, and Windows Server 2022. An authenticated attacker can exploit this vulnerability to gain elevated system privileges without user interaction. No patch is currently available.
Windows Virtualization-Based Security (VBS) Enclave contains an untrusted pointer dereference vulnerability that allows authenticated local users to achieve privilege escalation. The vulnerability affects Windows 11 versions 23h2, 24h2, and 25h2, and currently has no available patch. An attacker with local access can exploit this memory safety flaw to gain elevated system privileges.
Windows Win32K use-after-free vulnerability in ICOMP affects Windows 11 23h2 and Windows Server 2022 23h2, enabling authenticated local attackers to achieve privilege escalation with high impact on confidentiality, integrity, and availability. Currently no patch is available, and exploitation requires local access with user-level privileges.
Privilege escalation in Windows Win32K ICOMP component via use-after-free memory corruption affects Windows 11 (24h2, 25h2) and Windows Server 2025. An authenticated local attacker can exploit this vulnerability to gain SYSTEM-level privileges with no user interaction required. Currently no patch is available and exploitation requires local access with user-level permissions.
Windows Server and Windows 10/11 Connected Devices Platform Service (Cdpsvc) contains a heap buffer overflow that allows authenticated local users to escalate privileges to system level. The vulnerability requires low complexity exploitation with no user interaction, affecting multiple recent Windows versions including Server 2022, Windows 10 21h2, and Windows 11 23h2. No patch is currently available for this high-severity flaw.
Kernel-mode driver use-after-free vulnerabilities in Windows 11 24H2 and Windows Server 2025 enable authenticated local attackers to achieve privilege escalation. An attacker with standard user privileges can exploit memory corruption in kernel drivers to gain SYSTEM-level access without user interaction. No patch is currently available.
The Windows Ancillary Function Driver for WinSock contains an improper memory deallocation vulnerability (CWE-590) that allows authenticated local attackers to achieve privilege escalation on affected Windows 10 and Windows Server 2019 systems. An attacker with local user privileges can exploit this flaw to gain SYSTEM-level access without user interaction. No patch is currently available for this vulnerability.
Memory corruption in the Linux kernel's TPM 2.0 session-handling code (tpm2-sessions) arises because the 'name_size' value derived from a TPM_ALG_ID is used to index without range validation, so an unrecognized or malicious algorithm identifier can drive an out-of-bounds access. The affected TPM HMAC/authorization session path is reachable from local, low-privileged kernel-driver interactions; at worst this leads to kernel memory corruption affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.03%), consistent with a locally-scoped kernel hardening fix rather than a mass-exploited flaw.
Arbitrary code execution in Adobe InDesign versions 21.0, 19.5.5 and earlier via a heap buffer overflow vulnerability when users open malicious files. The flaw requires user interaction but allows attackers to execute code with the privileges of the current user. No patch is currently available for this high-severity issue.