CVE-2026-92370 Remote Session Access Control Bypass Leading to Remote Code Execution

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for...

CVE-2026-92370

An improper access control vulnerability in TeamViewer Full Client, Host , and related modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted fea...

CVE-2026-84784 QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

CVE-2026-84784

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804

The OpenSSL QUIC stack fails to enforce connection-level flow control for streams, a vulnerability categorized as CWE-770 . While the stack validates stream-level limits, it neglects connection-level limits, allowing a remote peer to send more bytes than permitted by the connection window as long...

EUVD-2026-89009

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

EUVD-2026-88999

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

An improper access control vulnerability exists in the partial connection API of Devolutions Server version 2026.3.5.0 and earlier . An authenticated low-privileged user can exploit this by sending a crafted API request to perform unauthorized actions, including reading, creating, modifying, and ...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-102568

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...

CVE-2025-33207

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-102568 Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...

CVE-2026-102568 Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...