CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28648

A permission bypass vulnerability exists in Settings due to a confused deputy flaw. This issue allows for local escalation of privilege without requiring additional execution privileges or user interaction. No specific software version, exploit links, or remediation steps are provided in the docu...

EUVD-2026-92630

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55270

A permission bypass exists in dialInternal at multiple locations due to a confused deputy vulnerability. This flaw could lead to local escalation of privilege without requiring additional execution privileges or user interaction. No specific details regarding affected software versions, the under...

cve-2026-0013-poc

CVE-2026-0013 Android DocumentsUI vulnerabilidad de proxy confundido Confused Deputy - Proyecto de verificación de investigación de seguridad Declaración importante Este repositorio es un repositorio de compilación derivado y mantiene una relación subordinada con el repositorio principal original...

StrandHogg2

StrandHogg2 Poc for StrandHogg2 CVE-2020-0096 Information of the original vulnerability Current Description In startActivities of ActivityStartController.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional...

CVE-2026-20516

CVE-2026-20516: MiracastService confused deputy on Android TV Research and disclosure by Davide Di Matteo @Dingo97. This is my first credited CVE. I found an improperly exported, system-privileged Miracast service while researching a PEAQ Android TV. A caller can supply an intent extra that makes...

CVE-2026-49086

Reproducción de Anulación de Encabezado de Enrutamiento / Confused Deputy en camel-dapr CVE-2026-49086 Este proyecto demuestra una falla de anulación de encabezado de enrutamiento confused-deputy en el componente camel-dapr de Apache Camel, registrada como CVE-2026-49086. El consumidor pub/sub de...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: emisión de credenciales antes de la validación de ubicación en register Un reproductor autónomo de un solo comando para CVE-2026-64640 : los endpoints register de Iceberg REST en Apache Polaris generan credenciales de almacenamiento en la nube para una ruta...

CVE-2026-95328

A flaw was found in chromium-browser. A confused deputy vulnerability—where a legitimate application is manipulated into misusing its authority—allows a local attacker to obtain sensitive information. By leveraging social engineering alongside a co-installed application on the device, an attacker...

PoC-in-GitHub

PoC in GitHub 2026 CVE-2026-0006 2026-03-02 In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

SummaryA critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent ca...

BIT-KIBANA-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_0144)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20250144 advisory. firefox: Use-after-free when breaking lines in text CVE-2025-0238 firefox: Memory corruption when using JavaScript Text Segmentation CVE-2025-0241 firefox:...

Kibana 9.4.x < 9.4.7 Privilege Escalation (ESA-2026-85)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.7. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-85 advisory. - Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A...

CVE-2026-95361

A flaw was found in chromium-browser. A confused deputy issue in the DevTools feature allows a remote attacker to bypass the browser's web origin policy. By using social engineering to trick a user into viewing a specially crafted HTML page, an attacker can exploit this vulnerability to improperl...

DEBIAN-CVE-2026-95361

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95361

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-95328

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Low...