CVE-2026-83597

The Netdata Windows Agent (versions 2.0.0 through 2.10.4) is vulnerable to a Local Privilege Escalation issue. During an MSI repair, the installer launches powershell.exe and wevtutil.exe as elevated interactive processes within the initiating user's desktop session. A low-privileged local user c...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598

The open-source observability tool Netdata is vulnerable to a Local Privilege Escalation (LPE) in the Windows Agent installer. From versions 2.0.0 until 2.10.4 , performing an MSI repair causes powershell.exe to execute as SYSTEM without the -NoProfile flag. This allows the process to load the %U...

EUVD-2026-84565

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

PT-2026-96843

Name of the Vulnerable Software and Affected Versions Netdata Windows Agent versions 2.0.0 through 2.10.3 Description The MSI repair process launches powershell.exe and wevtutil.exe as elevated interactive processes within the user's desktop session. A low-privileged local user can trigger this...

PT-2026-96844

Name of the Vulnerable Software and Affected Versions Netdata versions 2.0.0 through 2.10.3 Description During the MSI repair process of the Netdata Windows Agent, powershell.exe is executed with SYSTEM privileges without the -NoProfile flag. This causes the system to load the Microsoft.PowerShel...

CVE-2026-83597: Improper Privilege Management

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83598: Improper Privilege Management

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-40106 Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...

CVE-2026-40106 Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...

MAL-2026-10756 Malicious code in darkglitch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e3bc2b0ee4fc1f401e9d810e9ae30ee45ae822962099291c502e355f4bdcc7 darkglitch ships a remote-access agent that connects to the hardcoded signaling host wss://malware-signal.vercel.app on room D4RKGLI7CH and executes...

PT-2026-60610

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.6.0 through 4.14.4 Description A heap-based buffer overflow exists in the syscheck component of the Wazuh agent for Windows. The issue occurs when the agent expands registry paths containing wildcards or ?, as it allocates a...

Vulnerabilities exist in several Fortinet products

Fortinet has identified vulnerabilities in several versions of FortiSIEM Windows Agent and general product versions, FortiOS, FortiPAM, and FortiProxy. One vulnerability exists in the FortiSIEM Windows Agent versions 7.4.0 through 7.4.1 with the identifier CVE-2026-59841. This vulnerability allow...

EUVD-2026-43713

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via...

CVE-2026-59841

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via...

CVE-2026-59841

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via...

CVE-2026-59841

Technical details for CVE-2026-59841 are not publicly available in the provided documents. Monitor Fortinet advisories and NVD/CVE records for updates on affected product/version, impact, and fixes.

Malicious code in logger-daemon-regex (npm)

The npm package logger-daemon-regex is a full-spectrum information stealer and remote-control agent disguised as a "Node.js integration layer for Autodesk Forge" all bin names are forge-. A postinstall lifecycle hook chains five scripts postinstall-clipboard-event, ensure-dist,...

Veeam Backup and Replication < 13.0.2.29 (kb4852)

The version of Veeam Backup and Replication installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4852 advisory. - A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on...

CVE-2024-47091 Privilege escalation via mk_mysql agent plugin on Windows

Privilege escalation in the mkmysql agent plugin on Windows in Checkmk 2.4.0p29, 2.3.0p47, and 2.2.0 EOL allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' or with write access to a binary referenced by such a service to execute arbitrary cod...