CVE-2026-63689

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

Server-Side Request Forgery (SSRF)

org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...

CLEANSTART-2026-FS14470 flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input

Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input...

CVE-2026-106196: Missing Authorization

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106301: Unintended Proxy or Intermediary

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-63689: Insertion of Sensitive Information into Log File

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-101207: Improper Neutralization of Special Elements used in an OS Command

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...

CVE-2026-101149: Server-Side Request Forgery (SSRF)

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...

PT-2026-106974

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A confused deputy issue in Contextual Tasks allows a remote attacker who has compromised the renderer process to bypass system access restrictions to reach a privileged page by using a...

PT-2026-106863

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-105773

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

AZL-105959 CVE-2026-105773 affecting package clamav 1.5.4-2

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

CVE-2026-105773

Canimaan Software ClamXAV versions 3.3 through 3.11 are vulnerable to a local privilege escalation vulnerability within the Privileged Helper Tool . This issue is caused by a race condition combined with insufficient file validation , which could allow a local attacker to execute arbitrary code w...

CVE-2026-105773 Canimaan Software ClamXAV local privilege escalation

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

EUVD-2026-92797

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

CVE-2026-49933

A vulnerability exists in the msft.cc component within the handle_le_monitor_device_event function. An uninitialized pointer dereference allows for a potential control-flow hijack within a privileged Bluetooth process. This flaw could enable a local escalation of privilege without requiring addit...

Astra Linux – Vulnerability in edk2

Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure through network access...

Astra Linux – Vulnerability in Chromium

Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions and gain access to a privileged page through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Network of Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Creation of BPFMAPTYPEINODESTORAGE maps is rejected if BPF LSM is not initialized. When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if BPF LSM is not explicitly...