CVE-2026-27906

Summary: CVE-2026-27906 (Windows Hello) is a local security feature bypass caused by improper input validation, enabling an authenticated user with high privileges to bypass a security feature. The vulnerability affects Windows Hello components and has an indicative CVSSv3.1 base score of 4.4 (At...

CVE-2026-26175 Windows Boot Manager Security Feature Bypass Vulnerability

...

CVE-2026-26175

CVE-2026-26175 : Windows Boot Manager security feature bypass via use of an uninitialized resource, enabling a physical attacker to bypass protection. Affected component: Windows Boot Manager; root cause: uninitialized resource handling. Base CVSS 3.1 score 4.6 (PHYSICAL attack, LOW attack comple...

CVE-2026-26149

Technical details about CVE-2026-26149 are not publicly provided in the available documents. Monitor for updates from Microsoft and changelogs to learn affected components, impact, and remediation.

CVE-2026-26149 Microsoft Power Apps Desktop Client Spoofing Vulnerability

...

April 14, 2026-KB5082421 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1

None None...

April 14, 2026-KB5082419 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H2

None None...

Windows BitLocker Security Feature Bypass Vulnerability

Improper input validation in Windows BitLocker allows an unauthorized attacker to bypass a security feature locally...

Microsoft PowerShell Security Feature Bypass Vulnerability

Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...

Windows Recovery Environment Security Feature Bypass Vulnerability

Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack...

UEFI Secure Boot Security Feature Bypass Vulnerability

Improper access control in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

Windows Hello Security Feature Bypass Vulnerability

Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally...

PT-2026-32730

Name of the Vulnerable Software and Affected Versions Microsoft Power Apps affected versions not specified Description Improper neutralization of escape, meta, or control sequences allows an authorized attacker to bypass a security feature over a network. Recommendations At the moment, there is n...

Microsoft PowerShell 7.4.x < 7.4.14 / 7.5.x < 7.5.5 Security Feature Bypass (macOS)

The version of Microsoft PowerShell installed on the remote macOS host is 7.4.x prior to 7.4.14 or 7.5.x prior to 7.5.5. It is, therefore, affected by a security feature bypass vulnerability: - Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security...

Cisco IOS XR Privilege Escalation

The vulnerability of the command-line interface CLI of Cisco IOS XR operating systems is related to deficiencies in access control based on access control lists ACLs. Exploiting this vulnerability can allow attackers to enhance their privileges and bypass existing security mechanisms...

Totolink A7100RU Router setNtpCfg Arbitrary Command Execution

The vulnerability of the setNtpCfg function /cgi-bin/cstecgi.cgi in the Totolink A7100RU router’s microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the tz parameter. Exploiting this vulnerability allows...

NetAuth macOS Bypass

The vulnerability of the NetAuth component in macOS operating systems arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain control over the system and compromise the integrity and accessibility of the protected information...

OpenClaw Prototype Modification

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot relates to uncontrolled changes in the attributes of the object’s prototype. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms remotely...

OpenClaw validateBindMounts Bypass

The vulnerability of the validateBindMounts function in the AI agent OpenClaw formerly ClawdBot or MoltBot is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to bypass existing security mechanisms...

Totolink A7100RU Router setDdnsCfg Arbitrary Command Execution

The vulnerability of the setDdnsCfg function /cgi-bin/cstecgi.cgi of the Totolink A7100RU router software relates to the failure to eliminate special elements used in the operating system’s command for processing the provider parameter. Exploiting this vulnerability allows a malicious actor to...