CVE-2026-61355: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-68340

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

CVE-2026-72586

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

EUVD-2026-55220

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

PT-2026-69470

Name of the Vulnerable Software and Affected Versions frangoteam/FUXA versions prior to 1.3.4 Description A missing authentication flaw allows an unauthenticated remote attacker to query all historical sensor data. This occurs because the DAQ QUERY Socket.IO event handler in server/runtime/index....

Sensor Data Service Windows Privilege Escalation

The vulnerability of the Sensor Data Service system service in Windows operating systems is related to unauthorized access to the indexed resource. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2026-63965

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580triggerhandler declares its scan buffer on the stack without an initializer and then memcpys 3 bytes of 24-bit sensor data into each 4-byte le32 field. The hig...

Sensor Data Service Windows Privilege Escalation

The vulnerability of the Sensor Data Service system service in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain elevated privileges...

EUVD-2026-44667

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029...

EUVD-2026-43952

Incorrect access of indexable resource 'range error' in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-58619

Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-50367

Incorrect access of indexable resource 'range error' in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-58619

CVE-2026-58619 is a Windows Sensor Data Service vulnerability described as a use-after-free that enables an authorized attacker to locally elevate privileges. The vulnerability is reported with CVSS 3.1: LOCAL attack vector, HIGH impact (C, I, A), and low privileges required with no user interact...

CVE-2026-58619 Windows Sensor Data Service Elevation of Privilege Vulnerability

...

EUVD-2026-44306

Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

CVE-2026-58619 Windows Sensor Data Service Elevation of Privilege Vulnerability

...

CVE-2026-50367

CVE-2026-50367 describes an elevation of privilege in the Windows Sensor Data Service due to a logic flaw: incorrect access of an indexable resource (a range error). An authenticated local attacker could exploit this to escalate privileges on the affected system. The vulnerability’s CVSS 3.1 vect...