CVE-2026-55359

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55359

CVE-2026-55359 is a permission bypass caused by a logic error in the GPCA subcomponent of Google Pixel devices. It allows a local escalation of privilege from a low-privilege user account to full device compromise, with no user interaction required. The Pixel Update Bulletin rates it as Critical ...

CVE-2026-55302

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79160

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55302

CVE-2026-55302 is a Critical -severity elevation of privilege vulnerability in the Bootloader of Google Pixel devices. The root cause is a permission bypass due to a logic error in multiple locations, allowing an attacker with System -level privileges to escalate further without user interaction....

CVE-2026-0194

CVE-2026-0194 is a local privilege escalation vulnerability in the Trusted Execution Environment (TEE) of Google Pixel devices, caused by an integer overflow that permits a permission bypass . No additional execution privileges or user interaction are required for exploitation. The Pixel Update B...

CVE-2026-0194

In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79155

In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0189

In acinitpolicy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79153

In acinitpolicy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0189

CVE-2026-0189 is a permission bypass in the ac_init_policy function of init.c within the Bootloader component of Google Pixel devices, caused by a logic error. It enables local escalation of privilege with no additional execution privileges and no user interaction required. The CVSS 3.1 score is ...

CVE-2026-0179

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0179

CVE-2026-0179 is a Critical -severity elevation-of-privilege vulnerability in the Bootloader of Google Pixel devices, caused by a missing permission check that allows a local attacker with System execution privileges to bypass permissions. No user interaction is required. The vulnerability is tra...

Authentication Bypass

Apache CXF is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of required claims in self-issued OIDC ID tokens, including issuer, subject, audience, time, and subjwk binding, which allows an attacker to craft malicious tokens and bypass authentication when...

EUVD-2026-79144

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – 개인정보, 드라이버 및 메모리 문자열 setup.exe 드로퍼에 대한 Process Hacker 메모리 분석 결과, Lumma Stealer가 개인정보 설정을 대상으로 하고, 드라이버를 설치하며, 메모리를 관리하는 것으로 나타났습니다. 관찰된 주요 문자열: Privacy Camera – 카메라 개인정보 설정에 접근하거나 비활성화를 시도합니다. Privacy Microphone – 마이크 개인정보 설정에 접근하거나 비활성화를 시도합니다. PreinstallDriver – 지속성 또는 탐지 회피를 위한...

CVE-2020-1337

CVE-2020-1337 - 바이너리 심기 CVE-2020-1048 우회 Peleg Hadar @peleghd와 SafeBreach의 Tomer Bar @safebreach는 Windows 7 이상에서 권한 상승을 허용하는 Windows Spooler 취약점인 CVE-2020-1048로 Microsoft에 인정받았습니다. 일부 세부 사항은 Alex Ionescu @aionescu와 Yarden Shafir @yardenshafir가 그의 멋진 블로그 게시물 PrintDemon: Print Spooler Privilege...

CVE-2026-57442

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and nodemodules path segments do not match the restriction and pass both...

CVE-2026-57441

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...

CVE-2026-56829

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...