1126 matches found
CVE-2026-69864: Use After Free
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally...
CVE-2026-72980: Uncontrolled Search Path Element
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally...
CVE-2026-81354: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally...
CVE-2026-69710: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Hello allows an authorized attacker to elevate privileges locally...
CVE-2026-69799: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Hello allows an authorized attacker to elevate privileges locally...
PT-2026-87670
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Hello allows an authorized attacker to elevate privileges locally...
PT-2026-87891
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally...
CVE-2026-69740: Use After Free
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally...
CVE-2026-69725: Double Free
Double free in Windows Hello allows an authorized attacker to elevate privileges locally...
PT-2026-87693
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally...
BIT-MONGODB-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74044
Wazuh versions 4.0.0 through 4.14.5 are vulnerable: an authenticated cluster peer with a valid Fernet key can supply a path-traversal-shaped node name in the cluster hello payload; on disconnect, the master's peer cleanup routine deletes arbitrary directory contents within the wazuh user's writab...
EUVD-2026-61076
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-61928
Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally...
CVE-2026-61928 Windows Hello Tampering Vulnerability
...