OS & kernel CVEs.

Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

Auth & access OS & kernel

Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.

Auth & access OS & kernel

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Auth & access OS & kernel

Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.

Auth & access OS & kernel

Missing authentication for critical function in Remote Desktop Client allows an unauthorized attacker to perform tampering over a network.

Auth & access OS & kernel

Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.

Auth & access OS & kernel

Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Auth & access OS & kernel

Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network.

Auth & access OS & kernel

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25.

Auth & access OS & kernel

Missing authentication for critical function in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper access control in Windows Network File System allows an authorized attacker to disclose information locally.

Auth & access OS & kernel

Improper privilege management in Windows Deployment Services allows an authorized attacker to disclose information locally.

Auth & access OS & kernel

Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned "no remote clients" and granted access. This issue has been patched in version 0.9.3.

Auth & access OS & kernel

pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned "no remote clients" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3.

Auth & access OS & kernel

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper access control in Windows NTFS allows an authorized attacker to perform tampering locally.

Auth & access OS & kernel

Missing authentication for critical function in Microsoft Account allows an authorized attacker to perform tampering locally.

Auth & access OS & kernel

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

Auth & access OS & kernel

Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally.

Auth & access OS & kernel

Insufficiently protected credentials in Windows eSCL Scanner allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Auth & access OS & kernel

Missing authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper access control in Windows Hyper-V allows an authorized attacker to perform spoofing locally.

Auth & access OS & kernel

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper authorization in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.

Auth & access OS & kernel

Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Insufficiently protected credentials in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Auth & access OS & kernel

Missing authorization in Windows Win32K allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to perform tampering locally.

Auth & access OS & kernel

Improper access control in Windows Remote Access API allows an authorized attacker to perform tampering locally.

Auth & access OS & kernel

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

Auth & access OS & kernel

An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Auth & access OS & kernel

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.

Auth & access OS & kernel

Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to request attestation reports for VMPL 0.

Auth & access OS & kernel

Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Auth & access OS & kernel

Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation. This issue affects pardus-nvidia-installer: before 2.0.1.

Auth & access OS & kernel

Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality.

Auth & access OS & kernel

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.

Auth & access OS & kernel