CVE-2026-59126 Windows Event Logging Service Elevation of Privilege Vulnerability

...

CVE-2026-59126

The CVE refers to a race condition in Windows Event Logging Service where concurrent execution on a shared resource with improper synchronization can enable a local, authorized user to elevate privileges. Affected component: Windows Event Logging Service; root cause: race condition due to insuffi...

CVE-2026-61347

CVE-2026-61347 describes a buffer over-read in Windows Event Logging Service that allows an authorized attacker with LOW privileges and local access to disclose information. The CVSS 3.1 metrics indicate a MEDIUM base score (5.5), with LOCAL attack vector, low attack complexity, no user interacti...

CVE-2026-61347 Windows Event Logging Service Information Disclosure Vulnerability

...

CVE-2026-61347

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

EUVD-2026-56321

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-61347 Windows Event Logging Service Information Disclosure Vulnerability

...

CVE-2026-59137

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

EUVD-2026-56316

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-59137 Windows Event Logging Service Information Disclosure Vulnerability

...

CVE-2026-59137 Windows Event Logging Service Information Disclosure Vulnerability

...

CVE-2026-59137

Technical details about CVE-2026-59137 are not publicly provided in the supplied documents. No affected products, versions, or remediation are specified here. Monitor for updates from official sources.

Windows Event Logging Service Information Disclosure Vulnerability

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72546

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72547

CVE-2026-72547 affects Attendize (Attendize project) via the postImportAttendee endpoint. The flaw is an insecure direct object reference: the system loads the target event by ID without verifying ownership against the requesting organiser account, enabling any authenticated event organiser to bu...

CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72547 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...