CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

CVE-2026-97732

The IRONMACE Ironshield 1.0.0.167 software contains a vulnerability in its tvk.sys kernel-mode driver. The root cause is that the driver authenticates client executables by searching for specific strings ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" ) within WIN_CERTIFICATE data instead of...

EUVD-2026-86513

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

PT-2026-98838

Name of the Vulnerable Software and Affected Versions Seclore FileSecure Desktop Client versions prior to 3.25.1.0 Description An improper access control issue exists in the kernel-mode driver component. This allows an authenticated local user to elevate their privileges to NT AUTHORITYSYSTEM,...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153

The Seclore FileSecure Desktop Client before version 3.25.1.0 contains an improper access control vulnerability within its kernel-mode driver component. This flaw allows an authenticated local user to achieve privilege escalation to NT AUTHORITY\SYSTEM on affected systems. No specific exploit cod...

EUVD-2026-87080

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-97732: Improper Verification of Cryptographic Signature

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

CVE-2026-79153: Improper Privilege Management

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

PT-2026-98349

Name of the Vulnerable Software and Affected Versions IRONMACE Ironshield version 1.0.0.167 Description The tvk.sys kernel-mode driver authenticates client executables by verifying expected publisher and root-certificate strings within the WIN CERTIFICATE data, specifically checking for "IRONMACE...

CVE-2026-69421

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69421

CVE-2026-69421 is an integer underflow (wrap/wraparound) vulnerability in a Windows Kernel Mode Driver . An authorized local attacker can exploit the flaw to elevate privileges , with full impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/S:U/...

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69421: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

CVE-2023-20511: Release of Invalid Pointer or Reference

Release of an invalid pointer in the AMD kernel mode driver KMD could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution...

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group also known as Mustang Panda that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting,...