CVE-2026-20498

In geniezone, a missing permission check enables local escalation of privilege if an attacker already has System privileges. This vulnerability does not require user interaction. A patch identified as ALPS10900493 (Issue MSV-6765) is available to address the issue. The available connected records...

EUVD-2026-52087

In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10900493; Issue ID: MSV-6765...

CVE-2026-20496

In geniezone, a potential out-of-bounds read results from a missing bounds check, risking local information disclosure when an attacker already has the System privilege. Exploitation reportedly does not require user interaction. The mitigation provided in the sources is Patch ID ALPS11036877 (Iss...

EUVD-2026-52084

In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001,...

EUVD-2026-52080

In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10981501; Issue ID: MSV-7669...

CVE-2026-20488

CVE-2026-20488 : The description notes a missing bounds check in the display path that can lead to local information disclosure when the attacker already has System privileges, with no user interaction required. A patch is listed: ALPS11004276 (Issue MSV-7757). The connected documents do not spec...

EUVD-2026-52077

In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833...

EUVD-2026-52075

In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004...

CVE-2026-20484

CVE-2026-20484 in TFA describes information disclosure due to a missing permission check. A malicious actor who already has System privilege can exploit it locally without user interaction. The vulnerability affects the TFA component as described across multiple sources; exploitation status is no...

EUVD-2026-52071

In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935...

CVE-2026-20497

In geniezone, a vulnerability exists: an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege if an attacker already has System privilege. Exploitation reportedly does not require user interaction. Affected detail supports Patch IDs ALPS10965550 and ALPS113...

CVE-2026-20477

CVE-2026-20477 describes an out-of-bounds write in display caused by a missing bounds check, enabling local privilege escalation for an attacker already with System privileges; exploitation does not require user interaction. Patch available: ALPS11009963 (Issue MSV-7658). No vendor/product specif...

CVE-2026-20474

CVE-2026-20474 describes a race-condition in display that can lead to local privilege escalation if an attacker already has System privileges. No user interaction is required. The vulnerability details come from multiple sources (NVD/CVE records and related bulletins); exploitation status is not ...

CVE-2026-20472

CVE-2026-20472 affects TFA. The issue is an out-of-bounds write caused by a missing bounds check, leading to local denial of service if an attacker has System privileges; no user interaction is required. Patch ALPS10991467 (MSV-7764) is referenced. Public details in connected documents confirm th...

EUVD-2026-52058

In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741...

CVE-2026-44595

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one...

CVE-2026-44595

CVE-2026-44595 affects Yamcs’ core IAM API endpoints: GET /api/iam/users, GET /api/iam/users/{name}, GET /api/iam/groups, and GET /api/iam/groups/{name}. The root cause is missing enforcement of SystemPrivilege.ControlAccess in Yamcs’ IAM API (IamApi.java), enabling any authenticated user—even wi...

CVE-2026-21052

Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege...

CVE-2026-56437

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege...

CVE-2026-56437

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege...