CVE Vulnerability Advisory Database

[Affected Scope] GNOME Epiphany browser versions 47.0 and above

[Impact] Installing or opening a crafted WebExtension (.xpi) can cause user-writable files to be truncated and overwritten with attacker-controlled content and permissions without warning

[Mitigation] Immediately upgrade Epiphany to the patched version that restricts archive extraction to the ZIP format only

[Affected Scope] GNOME Epiphany browser versions 45.0 through at least 51.x

[Impact] Attackers can bypass permission prompts and access the camera and microphone without user consent, leading to audiovisual confidentiality exposure, if the user approves clipboard or website data access

[Mitigation] Immediately update Epiphany to the patched version containing upstream commit 480c3648

[Affected Scope] Dell OpenManage Enterprise versions prior to 4.8.0

[Impact] A low-privileged attacker with local access can bypass protection mechanisms by accessing critical resources, potentially leading to unauthorized data disclosure

[Mitigation] Immediately upgrade to Dell OpenManage Enterprise version 4.8.0 or later

[Affected Scope] Dell OpenManage Enterprise versions prior to 4.8.0

[Impact] A high-privileged local attacker can bypass protection mechanisms, potentially leading to system integrity and availability compromise

[Mitigation] Immediately upgrade Dell OpenManage Enterprise to version 4.8.0 or later

[Affected Scope] All versions of Siemens Software Center prior to V4.0.9.8

[Impact] A local attacker can execute arbitrary code with the application's privileges by placing a malicious DLL in the search path

[Mitigation] Immediately upgrade to Siemens Software Center V4.0.9.8 or later

[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.

[Impact] Unauthorized attackers can bypass security features and execute arbitrary commands, leading to full system compromise.

[Mitigation] Apply the latest Microsoft security updates immediately and restrict execution of untrusted URI handlers.

[Affected Scope] Zammad installations using DEB or RPM packages built via packager.io (Source and Docker excluded).

[Impact] A local attacker with 'zammad' service account access can escalate to full 'root' privileges on the host.

[Mitigation] Immediately update Zammad to the latest patched version via package manager.

[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.

[Impact] Processing a maliciously crafted file can lead to arbitrary code execution with system privileges, resulting in full device compromise.

[Mitigation] Immediately apply the latest security patches provided by Apple (e.g., iOS 18.7.11, macOS 15.8.1) and restart the device.

[Affected Scope] Acronis Backup plugins for Linux-based hosting panels (cPanel, Plesk, DirectAdmin) prior to specific builds.

[Impact] Local attackers can exploit insecure file permissions to gain root-level privileges on the host server, leading to full system compromise.

[Mitigation] Immediate update to the latest plugin versions (cPanel 1.9.3.1021+, Plesk 1.8.11.638+, DirectAdmin 1.2.3.238+).

[Affected Scope] Google Pixel devices and Android hardware utilizing specific cellular modem chipsets.

[Impact] Remote (proximal/adjacent) attackers can bypass permissions to escalate privileges without user interaction, leading to full modem compromise.

[Mitigation] Immediately apply the September 2026 or later Android security patches (2026-09-01).

[Affected Scope] Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers

[Impact] Remote attackers can execute arbitrary code within the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to version 153.0.8010.36 or later

[Affected Scope] Locally authenticated users across Microsoft Windows operating systems

[Impact] Local attackers can elevate privileges to SYSTEM level, gaining full control over the target system and executing arbitrary code

[Mitigation] Apply the official Microsoft security patches immediately and restrict local access on unpatched assets

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack

[Impact] A local authorized attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise

[Mitigation] Apply the official Microsoft security updates immediately, or restrict local symbolic link creation privileges as a temporary mitigation

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 152.0.7977.82

[Impact] A remote attacker can execute arbitrary code inside the browser's renderer sandbox by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (152.0.7977.82 or higher)

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)

[Impact] An authorized local attacker can exploit kernel memory corruption to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local access

[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled

[Impact] A remote attacker on the network can bypass authentication mechanisms to establish an unauthorized Screen Sharing session without valid credentials, gaining full GUI-level control over the target system

[Mitigation] Immediately apply the latest macOS security updates, or disable 'Screen Sharing' and 'Remote Management' services until patches can be deployed

[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled

[Impact] An authorized local attacker with low privileges can exploit insufficient access control granularity to elevate privileges to SYSTEM

[Mitigation] Apply the official Microsoft security updates immediately and audit AD FS service account and directory permissions

[Affected Scope] Linux kernel systems utilizing UDPv6 sockets with MSG_MORE and MSG_SPLICE_PAGES flags

[Impact] Unprivileged local users can trigger a heap out-of-bounds write, leading to system crash (Denial of Service) or Local Privilege Escalation (LPE)

[Mitigation] Apply the latest stable kernel patches from upstream or your Linux distribution vendor, and restrict unprivileged user namespaces if immediate patching is not feasible

[Affected Scope] Linux systems utilizing ebtables SNAT targets within bridge netfilter configurations.

[Impact] Local attackers can trigger kernel memory corruption, leading to Denial of Service (DoS) or Privilege Escalation.

[Mitigation] Apply the latest kernel security patches provided by your distribution and reboot.

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 149.0.7827.103

[Impact] Remote attackers can execute arbitrary code inside the V8 sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (149.0.7827.103 or higher)