Monthly
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
A permission bypass in the Location-Based Services (LBS) module of Huawei HarmonyOS and EMUI lets code that reaches the module's permission-checked interface operate outside its intended privilege context, with the vendor describing the resulting impact as availability-only. Affected baselines are HarmonyOS 4.0.0, 4.2.0, 4.3.0 and 4.3.1 plus EMUI 14.0.0, 14.2.0 and 15.0.0. Signals conflict on reachability: the published CVSS 3.1 vector (7.5) asserts network-reachable, unauthenticated attack (AV:N/PR:N/UI:N), while the independent assessment scores it AV:L/PR:L with no confidentiality or integrity impact, implying attacker-controlled code already running on the device is the realistic prerequisite. There is no KEV listing, SSVC records no observed exploitation and marks the issue not automatable, EPSS is 0.01%, and no public exploit code was identified at time of analysis.
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Freepbx versions up to 17.0.5 contains a vulnerability that allows attackers to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX tha (CVSS 7.5).
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes. Rated high severity (CVSS 8.1), this vulnerability is no authentication required. No vendor patch available.
Under heavy system utilization a random race condition can occur during authentication or token refresh operation. Rated medium severity (CVSS 6.0). No vendor patch available.
CVE-2025-46406 is a security vulnerability (CVSS 5.6) that allows a privileged operator with high level access. Remediation should follow standard vulnerability management procedures.
A security vulnerability in XWiki (CVSS 3.5). Risk factors: public PoC available. Vendor patch is available.
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memory. Rated high severity (CVSS 7.9), this vulnerability is low attack complexity. No vendor patch available.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
A permission bypass in the Location-Based Services (LBS) module of Huawei HarmonyOS and EMUI lets code that reaches the module's permission-checked interface operate outside its intended privilege context, with the vendor describing the resulting impact as availability-only. Affected baselines are HarmonyOS 4.0.0, 4.2.0, 4.3.0 and 4.3.1 plus EMUI 14.0.0, 14.2.0 and 15.0.0. Signals conflict on reachability: the published CVSS 3.1 vector (7.5) asserts network-reachable, unauthenticated attack (AV:N/PR:N/UI:N), while the independent assessment scores it AV:L/PR:L with no confidentiality or integrity impact, implying attacker-controlled code already running on the device is the realistic prerequisite. There is no KEV listing, SSVC records no observed exploitation and marks the issue not automatable, EPSS is 0.01%, and no public exploit code was identified at time of analysis.
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Freepbx versions up to 17.0.5 contains a vulnerability that allows attackers to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX tha (CVSS 7.5).
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes. Rated high severity (CVSS 8.1), this vulnerability is no authentication required. No vendor patch available.
Under heavy system utilization a random race condition can occur during authentication or token refresh operation. Rated medium severity (CVSS 6.0). No vendor patch available.
CVE-2025-46406 is a security vulnerability (CVSS 5.6) that allows a privileged operator with high level access. Remediation should follow standard vulnerability management procedures.
A security vulnerability in XWiki (CVSS 3.5). Risk factors: public PoC available. Vendor patch is available.
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memory. Rated high severity (CVSS 7.9), this vulnerability is low attack complexity. No vendor patch available.