CVE-2026-20815

CVE-2026-20815 is a race condition in the Capability Access Management Service (camsvc) that allows a locally authenticated user to elevate privileges. The vulnerability arises from concurrent execution on a shared resource with improper synchronization. Microsoft and multiple security bulletins ...

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

Capability Access Management Service (camsvc) Information Disclosure Vulnerability

Out-of-bounds read in Capability Access Management Service camsvc allows an unauthorized attacker to disclose information locally...

CVE-2025-71066 net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...

CVE-2025-71066 net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...

CVE-2025-14001

The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with...

CVE-2025-10915

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check...

CVE-2025-10915 Dreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check...

CVE-2025-10915 Dreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check...

CVE-2025-10915

The Dreamer Blog WordPress theme (versions

CVE-2026-20815: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2026-20830: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2026-20835: Out-of-bounds Read

Out-of-bounds read in Capability Access Management Service camsvc allows an authorized attacker to disclose information locally...

CVE-2026-20851: Out-of-bounds Read

Out-of-bounds read in Capability Access Management Service camsvc allows an unauthorized attacker to disclose information locally...

CVE-2026-21221: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2025-14001: Missing Authorization

The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with...

PT-2026-2685

Name of the Vulnerable Software and Affected Versions Capability Access Management Service camsvc affected versions not specified Description An out-of-bounds read exists in the Capability Access Management Service camsvc. A local attacker who is authorized can exploit this to disclose informatio...

PT-2026-2665

Name of the Vulnerable Software and Affected Versions Capability Access Management Service camsvc affected versions not specified Description A flaw exists that allows for privilege escalation. Concurrent execution using a shared resource with improper synchronization, specifically a race...