Monthly
Authenticated attackers with low privileges can escalate to elevated privileges on IBM i systems running Db2 Mirror for i 7.4, 7.5, or 7.6 by submitting a crafted request that bypasses additional authorization and input-validation checks, potentially allowing malicious code execution. This critical-severity (CVSS 9.9) privilege escalation affects standard deployments and requires a valid low-privilege account; no public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
Denial-of-service in Huawei HarmonyOS and EMUI's input device module allows a local unprivileged attacker to crash affected system components, impacting device availability. The CVSS scope change (S:C) indicates the flaw propagates availability impact beyond the vulnerable input module itself, potentially affecting higher-privileged or dependent subsystems. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated remote availability disruption in Huawei HarmonyOS 6.1.0 allows network-accessible attackers to exploit missing permission controls in the event notification module, causing high-severity service outages that propagate beyond the vulnerable component via a scope change. The vulnerability is rooted in CWE-264 (Permissions, Privileges, and Access Controls) and carries a CVSS 3.1 base score of 8.6 with no privilege or user-interaction requirements. Huawei issued remediation guidance in its September 2026 security bulletin covering smartphones, Vision devices, wearables, and laptops; no public exploit code has been identified at time of analysis.
Cisco IOS XR Software contains a task group mapping flaw in a specific CLI command that allows authenticated local attackers to bypass privilege checks and gain full administrative access to affected devices. An attacker with low-privileged credentials can exploit this misconfiguration to execute unauthorized administrative actions without proper authorization validation. No patch is currently available.
The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available.
In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.1%.
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Authenticated attackers with low privileges can escalate to elevated privileges on IBM i systems running Db2 Mirror for i 7.4, 7.5, or 7.6 by submitting a crafted request that bypasses additional authorization and input-validation checks, potentially allowing malicious code execution. This critical-severity (CVSS 9.9) privilege escalation affects standard deployments and requires a valid low-privilege account; no public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
Denial-of-service in Huawei HarmonyOS and EMUI's input device module allows a local unprivileged attacker to crash affected system components, impacting device availability. The CVSS scope change (S:C) indicates the flaw propagates availability impact beyond the vulnerable input module itself, potentially affecting higher-privileged or dependent subsystems. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated remote availability disruption in Huawei HarmonyOS 6.1.0 allows network-accessible attackers to exploit missing permission controls in the event notification module, causing high-severity service outages that propagate beyond the vulnerable component via a scope change. The vulnerability is rooted in CWE-264 (Permissions, Privileges, and Access Controls) and carries a CVSS 3.1 base score of 8.6 with no privilege or user-interaction requirements. Huawei issued remediation guidance in its September 2026 security bulletin covering smartphones, Vision devices, wearables, and laptops; no public exploit code has been identified at time of analysis.
Cisco IOS XR Software contains a task group mapping flaw in a specific CLI command that allows authenticated local attackers to bypass privilege checks and gain full administrative access to affected devices. An attacker with low-privileged credentials can exploit this misconfiguration to execute unauthorized administrative actions without proper authorization validation. No patch is currently available.
The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available.
In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.1%.
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.