The vulnerability of the Connected User Experiences and Telemetry operating system services allows attackers to enhance their privileges.

The vulnerability of the Connected User Experiences and Telemetry operating system services is related to data type mixing errors. Exploiting this vulnerability can allow attackers to enhance their privileges...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via the workflow execution outputs. An attacker can access sensitive information by abusing limited feature...

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3053-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3053-1 advisory. This update for ImageMagick fixes the following issues - CVE-2026-53466: integer overflow in the XCF decoder c...

CVE-2026-49997 SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purgeedges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone.withpermsfalse when a connected node was...

CVE-2026-49997

CVE-2026-49997 affects SurrealDB prior to version 3.1.0, where Document::purge_edges could bypass edge table permissions for delete and select when a connected node was deleted. The issue occurs as edge records connected to a deleted node were removed with permissions disabled, bypassing edge-tab...

Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read bsc1270073. CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure...

SUSE-SU-2026:3053-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues - CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read bsc1270073. - CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure...

EUVD-2026-43945

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network...

CVE-2026-50421

Access of resource using incompatible type 'type confusion' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

...

CVE-2026-50421

CVE-2026-50421 is a Windows vulnerability in Windows Connected User Experiences and Telemetry described as a local privilege escalation via a resource access type confusion. The CVE entry is supported by multiple records: NVD/NCSC/CIRCL indicate the issue and Microsoft has released updates to add...

CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

...

CVE-2026-47632

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Access of resource using incompatible type 'type confusion' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

PT-2026-58400

Name of the Vulnerable Software and Affected Versions Windows Connected User Experiences and Telemetry affected versions not specified Description A type confusion issue occurs when a resource is accessed using an incompatible type. This flaw allows an authorized local attacker to elevate their...

CVE-2026-50421: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

CVE-2026-47632: Improper Certificate Validation

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-62327

The vulnerability concerns 9Router up to version 0.4.41. An unauthenticated request to the Next.js API route /api/usage/stats is possible due to missing authentication middleware, leading to exposure of plaintext API keys for all connected AI provider accounts, along with token counts, costs and ...

MAL-2026-10459 Malicious code in connectedmerchantsserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 834b886e34ea551223e9eeb30561267c93226eac960729a9a0ff6a06277c74cf The package's scripts.install lifecycle hook runs node index.js, which loads lib/core.js. That module collects the installer's OS username, hostname,...