PT-2026-24437

Name of the Vulnerable Software and Affected Versions PowerVR GPU affected versions not specified Description The register protection of the PowerVR GPU is incorrectly configured, potentially leading to local information disclosure. Exploitation does not require additional execution privileges or...

PT-2026-24491

Improper buffer restrictions in some UEFI firmware for some IntelR reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access whe...

PT-2026-24553

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4-p16 through 2.4.9-alpha3 Description Adobe Commerce is affected by an Incorrect Authorization issue that could allow a security feature bypass. An attacker could exploit this to gain unauthorized view access to da...

PT-2026-24446

In mfc dec dqbuf of mfc dec v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-24449

Name of the Vulnerable Software and Affected Versions modem affected versions not specified Description An out-of-bounds write issue exists due to an incorrect bounds check. This could allow for remote code execution without requiring additional privileges or user interaction. Recommendations At...

PT-2026-24451

In multiple places, there is a possible out of bounds write due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-24441

In vpu open inst of vpu ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-24435

Name of the Vulnerable Software and Affected Versions KVM versions affected versions not specified Description An out-of-bounds write issue exists in the hyp alloc function within arch/arm64/kvm/hyp/nvhe/alloc.c. This is due to insufficient input validation. Successful exploitation could lead to...

PT-2026-24450

Name of the Vulnerable Software and Affected Versions VPU affected versions not specified Description A use-after-free read issue exists in VPU due to a race condition. Successful exploitation of this issue could lead to local information disclosure and does not require additional execution...

PT-2026-24443

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-24398

In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

M365Pwned Red Team Tool

M365Pwned is two WinForms GUI tools for enumerating, searching, and exfiltrating data from Microsoft 365 environments using application-level OAuth tokens without any user interaction required...

CVE-2025-48635

In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48644

In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48587

In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48602

In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitati...

CVE-2025-48645

In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48654

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48568

In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48577

In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...