Monthly
Insufficient access control granularity in docker-socket-proxy allows adjacent-network attackers without credentials to read arbitrary files and exfiltrate entire container filesystems via four unguarded Docker API endpoints. When the CONTAINERS environment variable is set, the HAProxy-based proxy fails to block /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, treating namespace-level permission as blanket endpoint permission. No active exploitation or confirmed public exploit code has been identified at time of analysis, though a researcher gist is referenced alongside the upstream fix in PR #183.
Tamper protection bypass in BeyondTrust Endpoint Privilege Management (EPM) for Windows allows local high-privileged users to circumvent agent protection controls by exploiting a flaw in how protections are applied to a support utility process. Affected versions are all EPM Windows Deployment releases prior to 26.1.2, per EUVD-2026-60270 and BeyondTrust advisory BT26-04. No public exploit has been identified and this is not in CISA KEV, but the high confidentiality, integrity, and availability impact on the vulnerable system makes this a meaningful concern for any organization relying on EPM as a core endpoint security control.
Cross-team credential disclosure in the Apache Airflow Google Provider's Cloud Secret Manager backend exposes every team's Connections and Variables to every other team in multi-team deployments. The backend's public methods accepted a team_name parameter but silently discarded it before the internal secret lookup, collapsing all team namespaces into one shared, unscoped lookup. No public exploit has been identified at time of analysis; the vendor-released fix is apache-airflow-providers-google 22.3.0.
Local privilege escalation in Windows User-Mode Power Service (UMPS) affects a broad swath of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authenticated low-privileged local user can exploit insufficient access control granularity (CWE-1220) in UMPS to elevate privileges, achieving full confidentiality, integrity, and availability impact consistent with SYSTEM-level access. No public exploit identified at time of analysis, but Microsoft has released patches across all affected build lines, making this a high-priority patching item for organizations running any of the 19 affected Windows configurations identified in EUVD-2026-56638.
Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Remote code execution in the Windows Event Logging Service affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025), where insufficient granularity of access controls (CWE-1220) lets an authenticated attacker with low privileges execute code over the network with high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds. There is no public exploit identified at time of analysis and CISA has not listed it in KEV, with a low EPSS score of 0.61%.
Local privilege escalation in the Windows Filtering Platform (WFP) lets an authenticated low-privileged user gain higher privileges on affected Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rooted in insufficient access-control granularity (CWE-1220), a local attacker with a valid session can manipulate WFP to reach SYSTEM-level access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft rates the confidentiality, integrity, and availability impact as High.
Local privilege escalation in Microsoft Surface devices (Go, Hub, Laptop Go/Go 3, Pro/Pro 8, Laptop 4 AMD/Intel, Windows Dev Kit) allows an authenticated low-privileged user to gain higher privileges through insufficiently granular access control (CWE-1220) in the device firmware/platform layer. The flaw carries a CVSS 7.8 (High) with full confidentiality, integrity, and availability impact once exploited, but requires prior local access. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a fix via MSRC.
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-privileged user on the host gain higher privileges due to insufficient granularity of access control (CWE-1220). Affected deployments span AD FS on Windows Server 2012 through Windows Server 2025, and the flaw carries a CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority-driven rather than exploitation-driven risk.
Insufficient access control granularity in docker-socket-proxy allows adjacent-network attackers without credentials to read arbitrary files and exfiltrate entire container filesystems via four unguarded Docker API endpoints. When the CONTAINERS environment variable is set, the HAProxy-based proxy fails to block /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, treating namespace-level permission as blanket endpoint permission. No active exploitation or confirmed public exploit code has been identified at time of analysis, though a researcher gist is referenced alongside the upstream fix in PR #183.
Tamper protection bypass in BeyondTrust Endpoint Privilege Management (EPM) for Windows allows local high-privileged users to circumvent agent protection controls by exploiting a flaw in how protections are applied to a support utility process. Affected versions are all EPM Windows Deployment releases prior to 26.1.2, per EUVD-2026-60270 and BeyondTrust advisory BT26-04. No public exploit has been identified and this is not in CISA KEV, but the high confidentiality, integrity, and availability impact on the vulnerable system makes this a meaningful concern for any organization relying on EPM as a core endpoint security control.
Cross-team credential disclosure in the Apache Airflow Google Provider's Cloud Secret Manager backend exposes every team's Connections and Variables to every other team in multi-team deployments. The backend's public methods accepted a team_name parameter but silently discarded it before the internal secret lookup, collapsing all team namespaces into one shared, unscoped lookup. No public exploit has been identified at time of analysis; the vendor-released fix is apache-airflow-providers-google 22.3.0.
Local privilege escalation in Windows User-Mode Power Service (UMPS) affects a broad swath of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authenticated low-privileged local user can exploit insufficient access control granularity (CWE-1220) in UMPS to elevate privileges, achieving full confidentiality, integrity, and availability impact consistent with SYSTEM-level access. No public exploit identified at time of analysis, but Microsoft has released patches across all affected build lines, making this a high-priority patching item for organizations running any of the 19 affected Windows configurations identified in EUVD-2026-56638.
Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Remote code execution in the Windows Event Logging Service affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025), where insufficient granularity of access controls (CWE-1220) lets an authenticated attacker with low privileges execute code over the network with high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds. There is no public exploit identified at time of analysis and CISA has not listed it in KEV, with a low EPSS score of 0.61%.
Local privilege escalation in the Windows Filtering Platform (WFP) lets an authenticated low-privileged user gain higher privileges on affected Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rooted in insufficient access-control granularity (CWE-1220), a local attacker with a valid session can manipulate WFP to reach SYSTEM-level access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft rates the confidentiality, integrity, and availability impact as High.
Local privilege escalation in Microsoft Surface devices (Go, Hub, Laptop Go/Go 3, Pro/Pro 8, Laptop 4 AMD/Intel, Windows Dev Kit) allows an authenticated low-privileged user to gain higher privileges through insufficiently granular access control (CWE-1220) in the device firmware/platform layer. The flaw carries a CVSS 7.8 (High) with full confidentiality, integrity, and availability impact once exploited, but requires prior local access. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a fix via MSRC.
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-privileged user on the host gain higher privileges due to insufficient granularity of access control (CWE-1220). Affected deployments span AD FS on Windows Server 2012 through Windows Server 2025, and the flaw carries a CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority-driven rather than exploitation-driven risk.