169417 matches found
CVE-2026-48581
CVE-2026-48581 affects Microsoft Surface. It describes insufficient granularity of access control enabling a locally authenticated attacker to escalate privileges (Impact: high; CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Connected records show the vulnerability in Surface Broker SDM...
CVE-2026-55014
Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally...
CVE-2026-55014
CVE-2026-55014 concerns Windows Remote Help Defense with an improper access control vulnerability that lets an authorized attacker locally elevate privileges. Documented CVSSv3.1: 7.8 (HIGH) — LOCAL, LOW complexity, LOW privileges required, NONE user interaction; impact to confidentiality, integr...
CVE-2026-56155
Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...
CVE-2026-55006
Microsoft Exchange Server vulnerability CVE-2026-55006: Insufficient granularity of access control enables local privilege escalation for an authorized attacker. Root cause: lack of fine-grained access controls. Impact: high confidentiality, integrity, and availability impact per CVSS 3.1 (AV:L/A...
CVE-2026-55006
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...
CVE-2026-49170
CVE-2026-49170 affects the Windows StateRepository API server file due to insufficient granularity in access control, enabling an authorized local attacker to elevate privileges. Base metrics show CVSS v3.1: 7.8 (HIGH) with local access, low attack complexity, low privileges required, and no user...
BIT-PARSE-2026-57481 Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL rea...
BIT-NATS-2026-58214 NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protoc...
M365 Copilot for iOS Elevation of Privilege Vulnerability
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...
Win32k Elevation of Privilege Vulnerability
Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...
Windows Remote Help Defense Elevation of Privilege Vulnerability
Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally...
Windows StateRepository API Server file Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally...
Windows MIDI Service Module Elevation of Privileges Vulnerability
Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...
Windows Kernel Security Feature Bypass Vulnerability
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally...
Microsoft SharePoint Server Spoofing Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
Windows DNS Client Tampering Vulnerability
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...
DNS Client Tampering Vulnerability
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...