CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

...

CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

...

CVE-2026-47632

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Access of resource using incompatible type 'type confusion' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

CVE-2026-47632: Improper Certificate Validation

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-50421: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

PT-2026-58400

Name of the Vulnerable Software and Affected Versions Windows Connected User Experiences and Telemetry affected versions not specified Description A type confusion issue occurs when a resource is accessed using an incompatible type. This flaw allows an authorized local attacker to elevate their...

CVE-2026-62327

The vulnerability concerns 9Router up to version 0.4.41. An unauthenticated request to the Next.js API route /api/usage/stats is possible due to missing authentication middleware, leading to exposure of plaintext API keys for all connected AI provider accounts, along with token counts, costs and ...

MAL-2026-10459 Malicious code in connectedmerchantsserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 834b886e34ea551223e9eeb30561267c93226eac960729a9a0ff6a06277c74cf The package's scripts.install lifecycle hook runs node index.js, which loads lib/core.js. That module collects the installer's OS username, hostname,...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read bsc1270073. CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure...

CVE-2026-10103 Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

CVE-2026-10103

Mattermost versions affected: 11.7.x (up to 11.7.2), 11.6.x (up to 11.6.4), and 10.11.x (up to 10.11.19) have a flaw in the shared channel inbound sync handler that fails to verify post ownership. This allows an authenticated remote cluster to modify or delete posts authored by local users or oth...

CVE-2026-51540

OpENer version 2.3.0 (master branch up to commit 76b95cf ) is vulnerable to a severe memory corruption issue. The flaw is caused by an integer underflow occurring during the processing of connected explicit messages within the SendUnitData() function. Exploitation details are not provided in the ...

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-21056

Samsung Health before version 7.00.0.107 has an improper authorization flaw that enables local attackers to access information on connected devices. The issue is limited to local access with low privileges per the CVSS metrics, and the impact is confined to confidentiality of connected-device inf...

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-21056: Undefined Security Weakness

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-14898

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

CVE-2026-14898

The OpenAI Codex desktop app for macOS contains a vulnerability where it renders remote images from Markdown in model responses. An attacker can use indirect prompt injection via untrusted sources or connected-tool results to trick the model into constructing a remote image URL containing sensiti...