summary: Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.193 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel Connectivity Performance Suite security vulnerability


default_status: unaffected

product: Intel(R) TDX modules

status: affected

version: See references

ecosystem: software/application

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Awaiting Analysis

summary: Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.


product: Intel(R) PROSet/Wireless WiFi Software

severity: high

summary: Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.


product: libbiosig

vendor: The Biosig Project

version: Master Branch (db9a9a63)

part: a

status: Analyzed

summary: A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

title: Libbiosig Project Libbiosig security vulnerability


ecosystem: windows/system

summary: Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.


product: Gitea Open Source Git Server

vendor: Gitea

version_type: semver

status: Deferred

summary: Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

title: Gitea Gitea Open Source Git Server security vulnerability


summary: Uncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.

title: Intel(R) Proset/Wireless Wifi Software For Windows security vulnerability


vendor: CloudCharge

version: All versions

metric_type: Primary

severity: critical

vendor: cloudcharge

status: Modified

summary: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

title: Cloudcharge Cloudcharge.Se security vulnerability


version: before version 1.13

vendor: intel

summary: Buffer overflow for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel Quickassist Technology security vulnerability


product: Intel(R) NPU Driver

version: all versions

summary: Improper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Npu Driver security vulnerability


summary: Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.


summary: Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.


summary: Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (low) and availability (low) impacts.


vendor: Chargemap

vendor: chargemap

summary: Charging station authentication identifiers are publicly accessible via web-based mapping platforms.


summary: The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.


severity: low

summary: Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.


version: before version 2.0.2

summary: Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

title: Intel(R) Data Center Graphics Driver For Vmware Esxi Software security vulnerability


summary: Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.


product: Copeland XWEB 300D PRO

vendor: Copeland

version_type: custom

product: Copeland XWEB 500D PRO

product: Copeland XWEB 500B PRO

ecosystem: operating-system

part: o

vendor: copeland

summary: A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.

title: Copeland Xweb 300D Pro Firmware security vulnerability


product: Battery Life Diagnostic Tool software

version: before version 2.9.0

summary: Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Battery Life Diagnostic Tool Software security vulnerability


product: gitea

vendor: gitea

summary: Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.


default_status: affected

product: NxWitness VMS and Hanwha VMS Integrations

vendor: Gallagher

vendor: gallagher

summary: Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams. This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.

title: Gallagher Hanwha Vms Integration security vulnerability


product: Microsoft SQL Server 2022 (GDR)

vendor: Microsoft

product: Microsoft SQL Server 2022 for x64-based Systems (CU 22)

product: Microsoft SQL Server 2025 for x64-based Systems (GDR)

vendor: microsoft

summary: Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.


platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1607

product: Windows 10 Version 1809

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

platforms:
ARM64-based Systems
x64-based Systems

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.


product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

known_ransomware_campaign_use: Unknown

product: Windows

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Microsoft

vulnerability_name: Microsoft Windows Information Disclosure Vulnerability

summary: Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.


product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows 11 version 26H1

product: Windows Server 2022, 23H2 Edition (Server Core installation)

summary: Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.


product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 11 24H2 security vulnerability


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.


product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

archetype: generic

summary: Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.


product: Windows Server 2022

summary: Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 11 23H2 security vulnerability


product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

summary: Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.

title: Microsoft Windows 10 1607 security vulnerability


summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.


summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.


product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2012

summary: Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.


product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 10 21H2 security vulnerability


summary: Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally.


summary: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

summary: Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.


product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.


product: Windows Server 2016

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.


product: Windows Server 2016 (Server Core installation)

summary: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.


product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

summary: Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.


product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

summary: Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally.


product: Windows 10 Version 1607

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1809

summary: Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to disclose information locally.


product: Windows 10 Version 21H2

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2012

summary: Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack.


product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2019

product: Windows Server 2025 (Server Core installation)

summary: Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally.


title: Microsoft Windows Server 2025 security vulnerability


summary: Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.


product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability


product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

summary: Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally.


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

summary: Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.


product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

summary: Out-of-bounds read in Capability Access Management Service (camsvc) allows an authorized attacker to disclose information locally.


product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.


product: Windows Server 2019

product: Windows Server 2025 (Server Core installation)

summary: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.


product: Windows Server 2022

summary: Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.


product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

summary: Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally.


product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

summary: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.


product: Windows Notepad

summary: Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.

title: Microsoft Windows Notepad security vulnerability


product: Windows 10 Version 21H2

summary: Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows Server 2008 R2 Service Pack 1

summary: Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.


product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019 (Server Core installation)

summary: Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally.


product: Microsoft Office for Android

product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 version 26H1

product: Windows Server 2012 R2

summary: Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.


product: Windows 11 Version 25H2

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

summary: Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network.


product: Windows 10 Version 21H2

product: Windows Server 2012 R2 (Server Core installation)

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

summary: Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network.


product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.


product: Windows 10 Version 22H2

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.


product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.


summary: Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.


product: Windows 10 Version 21H2

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

summary: Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.


product: Windows 10 Version 1809

product: Windows Server 2022, 23H2 Edition (Server Core installation)

summary: Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.


product: Windows Server 2025

summary: Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.


product: Windows Server 2025 (Server Core installation)

summary: Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1607

product: Windows 10 Version 22H2

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

summary: Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.


product: Windows 11 version 23H2

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 10 1809 security vulnerability


product: Windows 10 Version 21H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally.


summary: Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1809

summary: Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.


product: Windows Server 2022, 23H2 Edition (Server Core installation)

title: Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally


product: Windows Server 2012

summary: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.


summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.


product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 22H2

summary: Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1607

product: Windows Server 2008 R2 Service Pack 1

summary: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.


product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

summary: Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.


product: Windows 11 version 23H2

summary: Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.


summary: Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.


summary: Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.


summary: Divide by zero for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.


vendor: Mobiliti

vendor: mvm

summary: The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.


product: Gitea Open Source Git Server

product: gitea

summary: Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.


product: LibRaw

vendor: LibRaw

version: Commit 8dc68e2

author: Codex

description: CVE-2026-20884 is LibRaw leftover. GHAD vulnerabilities empty. NVD CPE is exact 0.22.1. Commit 8dc68e2 is not a floor. Do not invent 0.22.2.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-20884: LibRaw leftover dump, GHAD vulnerabilities empty

product: libraw

vendor: libraw

recipe_kind: markdown-draft

summary: An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


product: Intel(R) platforms

summary: Improper authentication in the Intel(R) TDX module for some Intel(R) platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (none) impacts.

title: Intel(R) Platforms security vulnerability


summary: Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.


product: Intel Vision software

summary: Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.


vendor: Gitea

summary: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.


version: Commit d20315b

product: Red Hat Enterprise Linux 8

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

description: CVE-2026-20889 is a heap overflow in LibRaw x3f_thumb_loader. GHSA names no version range and no floor. Do not invent a LibRaw tag.

title: CVE-2026-20889: LibRaw x3f_thumb_loader, No Named Floor

summary: A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


summary: Improper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (high) impacts.

title: Intel(R) Proset/Wireless Wifi Software For Windows security vulnerability


summary: Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (low) and availability (low) impacts.


vendor: Micro Research Ltd.

version: firmware versions prior to v2.01.04N1_02

summary: Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands.

title: Micro Research Ltd. Mr-Gm5L-S1 security vulnerability


vendor: Fujitsu Client Computing Limited

version: 2.0.25.0 and earlier

summary: Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability is exploited, an attacker who can log in to the Windows system where the affected product is installed may execute arbitrary code with SYSTEM privilege and/or modify the registry value.


product: Multiple Network Cameras TRIFORA 3 series

vendor: TOA Corporation

version: see the information provided by the vendor

summary: Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product with some malicious input, an arbitrary script may be executed on the web browser of a victim administrator who accesses the setting screen.


summary: The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

title: Ev2Go Ev2Go.Io security vulnerability


description: CVE-2026-20896 ships Gitea Docker through 1.26.2 with REVERSE_PROXY_TRUSTED_PROXIES=*. Upgrade the image to 1.26.3+. Do not copy 1.25.5 from the other Gitea draft.

title: CVE-2026-20896: Gitea Docker Trusted Proxies Star

summary: Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

title: Gitea Gitea Open Source Git Server security vulnerability


summary: Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.


product: in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attac…

summary: Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.

title: In Alias Checking Trusted Module For Some Intel(R) Xeon(R) Processors M… security vulnerability


product: Intel(R) Xeon(R) processors

summary: Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (none) impacts.


product: Copeland XWEB 300D PRO

product: Copeland XWEB 500D PRO

product: Copeland XWEB 500B PRO

summary: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route.

title: Copeland Xweb 300D Pro Firmware security vulnerability


product: Intel(R) AI Containers

version: before version v0.4.0

summary: Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Ai Containers security vulnerability


product: Gitea Open Source Git Server

product: gitea

summary: Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.


version: before version 2.6

vendor: intel

summary: Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel Quickassist Technology security vulnerability


product: Intel(R) Neural Compressor software

version: before version v3.6

summary: Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Neural Compressor Software security vulnerability


product: Intel(R) NPU Driver for Windows

summary: Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Npu Driver For Windows security vulnerability


summary: Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.


vendor: Copeland

summary: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.


product: LibRaw

version: Commit 0b56545

description: CVE-2026-20911 is a heap overflow in LibRaw HuffTable::initval. GHSA names no version range and no floor. Do not invent a LibRaw tag.

title: CVE-2026-20911: LibRaw HuffTable::initval, No Named Floor

product: libraw

summary: A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


summary: Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.


version: before version v3.7

summary: Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.


version: before version 2.6.0

summary: Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.


product: Checkmk

vendor: Checkmk GmbH

ecosystem: javascript/npm

product: checkmk

vendor: checkmk

summary: Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

title: Checkmk security vulnerability


default_status: unknown

product: BIG-IQ

description: CVE-2026-20916 is BIG-IQ low-privilege iControl REST arbitrary file write. GHSA names no version range and no floor. Do not invent a TMOS tag.

title: CVE-2026-20916: BIG-IQ iControl File Write, No Named Floor

summary: An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

title: F5 Big-Iq Centralized Management security vulnerability


product: Intel(R) Processors

version: See references

summary: Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

title: Intel(R) Processors security vulnerability


product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 10 1809 security vulnerability


product: Windows 10 Version 1607

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

product: Windows Server 2016

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

title: Microsoft Windows 10 1607 security vulnerability


summary: Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)


product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.


product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.


title: Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally


product: Windows 10 Version 1607

product: Windows Server 2012

summary: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.


product: Windows 10 Version 1809

product: Windows 10 Version 21H2

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network.


product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows 11 version 26H1

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

summary: Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.


product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

summary: Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.


product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows Server 2012

summary: External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.


product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

summary: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.


summary: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.

title: Microsoft Windows 11 23H2 security vulnerability


product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

summary: Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.


product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

summary: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.


product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

summary: Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.


product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 11 24H2 security vulnerability


product: Microsoft Office 2016

product: Microsoft Office Deployment Tool

product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

product: office

summary: Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.


product: Microsoft 365 Apps for Enterprise

product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

summary: Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

title: Microsoft Sharepoint Server security vulnerability


product: Microsoft Excel 2016

product: Microsoft Office 2019

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

product: excel

summary: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


summary: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.


product: Microsoft Word 2016

summary: Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.


product: Office Online Server

summary: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


summary: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.


summary: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.


title: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally


summary: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


title: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally


summary: Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


archetype: ssrf

summary: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.


product: Microsoft Power Apps Desktop Client

summary: Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network.


product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.


product: Microsoft SharePoint Server 2019

business_risk: Critical remote code execution risk for exposed, unpatched on-premises SharePoint deployments. The vulnerability is reachable over the network, requires no user interaction or privileges according to the published CVSS vector, and is listed in CISA's Known Exploited Vulnerabilities catalog. Successful exploitation could affect confidentiality, integrity, and availability.

claim: Microsoft identifies Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition as affected products.

claim: The affected-version thresholds are below 16.0.5535.1001 for SharePoint 2016, below 16.0.10417.20083 for SharePoint 2019, and below 16.0.19127.20442 for SharePoint Subscription Edition.

claim: The published CVSS vector specifies network attack vector, low attack complexity, no privileges required, and no user interaction: AV:N/AC:L/PR:N/UI:N.

kind: exposure

claim: CISA lists CVE-2026-20963 in the Known Exploited Vulnerabilities catalog with a required action to apply vendor mitigations or discontinue use if mitigations are unavailable.

claim: Microsoft's SharePoint update history lists the January 13, 2026 SharePoint 2016 update at build 16.0.5535.1001.

claim: Microsoft's SharePoint update history lists the January 13, 2026 SharePoint Server 2019 updates at build 16.0.10417.20083.

claim: Microsoft's SharePoint update history lists the January 13, 2026 Subscription Edition update at build 16.0.19127.20442.

claim: Microsoft states that SharePoint updates are cumulative and provides the update history and build numbers for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.

kind: remediation

claim: Microsoft's SharePoint update-history page provides the applicable product update entries, KB identifiers, release dates, and build numbers that can be used to compare an installed farm build with the fixed thresholds.

kind: verification

exposure_conditions: SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition is deployed.

exposure_conditions: The installation is below the applicable Microsoft security-update build.

exposure_conditions: The SharePoint service is network reachable by an attacker; the published CVSS vector specifies AV:N, PR:N, and UI:N.

exposure_conditions: The affected deployment is an on-premises/server installation; the cited product records do not establish applicability to SharePoint Online.

remediation_steps: Apply Microsoft's January 13, 2026 security updates or any later cumulative SharePoint update.

remediation_steps: For SharePoint Enterprise Server 2016, update to build 16.0.5535.1001 or later.

remediation_steps: For SharePoint Server 2019, update to build 16.0.10417.20083 or later; Microsoft identifies KB5002825 and KB5002823 in the January 13, 2026 update entry.

remediation_steps: For SharePoint Server Subscription Edition, update to build 16.0.19127.20442 or later; Microsoft identifies KB5002822 in the January 13, 2026 update entry.

remediation_steps: Because SharePoint updates are cumulative, use the current supported cumulative update rather than relying on an older individual package. Follow Microsoft's deployment requirements for core and language-dependent updates where applicable.

remediation_steps: Prioritize remediation immediately because the vulnerability is included in CISA's Known Exploited Vulnerabilities catalog.

status: complete

uncertainty: The NVD record identifies SharePoint 2016 and SharePoint 2019 as affected product lines but does not display a separate version threshold for those products beyond Microsoft's affected-version records.

uncertainty: The available authoritative sources establish network-based, unauthenticated exploitability from the CVSS vector but do not describe additional deployment-specific exposure prerequisites such as reverse-proxy topology, authentication configuration, or internet exposure.

uncertainty: The sources establish fixed builds and update history but do not provide a product-specific, non-invasive runtime health check for confirming remediation beyond comparing the installed build with Microsoft's published update records.

verification_steps: Identify the installed SharePoint farm/build version using the organization's approved administrative inventory or SharePoint administration process.

verification_steps: Compare the reported build with the applicable Microsoft thresholds: 16.0.5535.1001 for SharePoint 2016, 16.0.10417.20083 for SharePoint 2019, or 16.0.19127.20442 for Subscription Edition.

verification_steps: Confirm that the installed update corresponds to the Microsoft SharePoint update history and that all update components required for the farm, including applicable language-dependent updates, are installed.

verification_steps: Record the update KB, installed build, deployment date, and affected server/farm scope for remediation tracking. Do not perform exploit testing against production systems.

product: SharePoint

vulnerability_name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

summary: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.


product: Windows Admin Center in Azure Portal

summary: Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.


product: System Center Operations Manager 2019

product: System Center Operations Manager 2022

product: System Center Operations Manager 2025

summary: Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.


product: Samsung Mobile Devices

vendor: Samsung Mobile

version: SMR Jan-2026 Release in Android 13, 14, 15, 16

product: android

vendor: samsung

summary: Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.


version: SMR Jan-2026 Release in Selected Android 13, 14, 15, 16 devices

summary: Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering this vulnerability.


version: SMR Jan-2026 Release in Android 15, 16

summary: Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.


summary: Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.


summary: Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.


summary: Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.


summary: Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.

title: Samsung Android security vulnerability


product: Samsung Cloud

product: cloud

summary: Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path.

title: Samsung Cloud security vulnerability


product: Galaxy Store

summary: Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.


version: SMR Feb-2026 Release in Android 14, 15, 16

summary: Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning.


version: SMR Feb-2026 Release in Android 13, 14, 15

summary: Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.

title: Samsung Android security vulnerability


version: SMR Feb-2026 Release in Android 15, 16

summary: Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.

title: Samsung Android security vulnerability


summary: Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.


summary: Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privilege.

title: Samsung Android security vulnerability


summary: Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.


summary: Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.

title: Samsung Android security vulnerability


product: Galaxy Wearable

summary: Improper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device prior to version 2.2.68 allows local attackers to access sensitive information.

title: Samsung Mobile Galaxy Wearable security vulnerability


product: Samsung Members

product: members

summary: Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability.

title: Samsung Members security vulnerability


product: Chinese Samsung Members

summary: Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members.


product: GalaxyDiagnostics

summary: Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands.


version: SMR Mar-2026 Release in Android 16

summary: Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.

title: Samsung Android security vulnerability


summary: Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.

title: Samsung Android security vulnerability


version: SMR Mar-2026 Release in Android 14, 15, 16

summary: Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege.

title: Samsung Android security vulnerability


summary: Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.


version: SMR Mar-2026 Release in Android 13, 14, 15, 16

summary: Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.

title: Samsung Android security vulnerability


product: Samsung Assistant

product: assistant

summary: Improper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved information.

title: Samsung Assistant security vulnerability


product: Samsung Account

product: account

summary: URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.


product: Smart Switch

summary: Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.

title: Samsung Smart Switch security vulnerability


summary: Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.


summary: Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.


summary: Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.


summary: Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.