14933 matches found
CVE-2026-58598
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Backup Engine allows an authorized attacker to elevate privileges locally...
CVE-2026-58598 Windows Backup Service Elevation of Privilege Vulnerability
...
CVE-2026-58598 Windows Backup Service Elevation of Privilege Vulnerability
...
CVE-2026-58598
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Backup Engine allows an authorized attacker to elevate privileges locally...
CVE-2026-58598
Technical details are not publicly available in the provided documents. Monitor for updates from vendors and advisories for CVE-2026-58598.
CVE-2026-46515
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...
CVE-2026-46515 Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...
CVE-2026-46515
CVE-2026-46515 (Frogman) affects Frogman’s headless PBX control via MCP and HTTP API. Before version 1.6.3, a PERM_READ privilege was sufficient to call multiple endpoints (fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query...
EUVD-2026-44948
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists a...
CVE-2026-14890
SGLang is vulnerable to unauthenticated remote code execution via its expert-parallel backup subsystem. The issue centers on a ZeroMQ PULL socket exposed on a routable network interface with no authentication or deserialization safeguards, allowing an attacker to send a malicious pickle payload t...
CVE-2026-14890 CVE-2026-14890
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when...
CVE-2026-14890 CVE-2026-14890
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when...
Windows Backup Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Backup Engine allows an authorized attacker to elevate privileges locally...
How to Export Veeam Backup for Salesforce Data to Cloud Storage
Purpose This article covers vbsf-export, a standalone utility that exports Salesforce backup data from a Veeam Backup for Salesforce deployment to cloud storage. The exported files can then be used, for example, with the Data Import feature of Veeam Data Cloud for Salesforce to migrate the backup...
SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem
Overview A Pickle deserialization vulnerability has been discovered within the SGLang project, enabling an attacker to perform remote code execution RCE on the target vulnerable server. In order for an attacker to exploit this vulnerability, the expert-parallel backup subsystem must be enabled, a...
CVE-2026-55410 NocoBase backup restore schema name allows command injection
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...
CVE-2026-55410 NocoBase backup restore schema name allows command injection
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...
CVE-2026-55410
NocoBase (with the @nocobase/plugin-backups) prior to version 2.1.19 is vulnerable. The backups restoration flow interpolates database.schema from _metadata.json into Node.js child_process.exec() shell commands, enabling a backup-management user to execute arbitrary commands with the NocoBase ser...
PT-2026-60340
G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target...