UBUNTU-CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group also known as Mustang Panda that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting,...

CVE-2026-50544

CVE-2026-50544 affects NortheBridge/luminalshine (Moonlight-compatible game stream host). On Windows, prior to version 26.05.0-rc4, a file created by the SYSTEM service resides at C:\ProgramData\LuminalShine\config\apps.json via src/platform/windows/misc.cpp. Under default ProgramData inheritance...

EUVD-2026-56403

Use after free in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2026-62892

CVE-2026-62892 is a use-after-free vulnerability in the Capability Access Management Service (camsvc) that could allow an authorized attacker to elevate privileges locally. The publicly available data identifies a local attack vector with high impact (confidentiality, integrity, and availability)...

CVE-2026-61936

CVE-2026-61936 describes a local security bypass in the Windows Defender Firewall Service where missing authorization allows an authorized attacker to bypass a security feature locally. The NVD entry and CVE records corroborate this description. According to the provided metrics, the impact is hi...

Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious file...

CVE-2026-50450

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally...

CVE-2026-54989

Use after free in Quality Windows Audio/Video Experience QWAVE service allows an authorized attacker to elevate privileges locally...

PT-2026-58198

Name of the Vulnerable Software and Affected Versions Windows MIDI Service Module affected versions not specified Description Improper access control in the Windows MIDI Service Module allows an authorized attacker to elevate privileges locally, which can lead to full system compromise...

FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)

Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)

Fetch and execute an x64 payload from an FTP server. Connect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation

Exploit Title: MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation Google Dork: N/A Date: 2026-06-16 Exploit Author: Mohammad Vendor Homepage: https://www.memuplay.com Software Link: https://www.memuplay.com/download.html Version: 9.2.7.0 Tested on: Windows 10 x64 / Windows 11 x64 CVE:...

SMB to Meterpreter Upgrade via PsExec

Upgrades an authenticated SMB session to a Meterpreter session using PsExec techniques. This module uploads a service-wrapped executable payload to the ADMIN$ share via the existing authenticated SMB connection, then creates and starts a Windows service that executes the payload. This mirrors the...

CVE-2019-25747

Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that allows local attackers to escalate privileges by placing malicious executables in intermediate directories. Attackers can exploit the unquoted path in the service configuration to execute arbitrar...

CVE-2020-37254 Wondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service Path

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot...

CVE-2020-37254 Wondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service Path

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot...

EUVD-2020-31255

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot...

PT-2026-50914

Name of the Vulnerable Software and Affected Versions Network Inventory Advisor version 5.0.26.0 Description The niaservice service is installed with an unquoted binary path. This configuration allows local attackers to escalate privileges by placing malicious executables in intermediate...

CVE-2022-4991 Tychon is vulnerable to privilege escalation due to OPENSSLDIR location

Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an...