CVE Vulnerability Advisory Database

[Affected Scope] Google Pixel devices and Android hardware utilizing specific cellular modem chipsets.

[Impact] Remote (proximal/adjacent) attackers can bypass permissions to escalate privileges without user interaction, leading to full modem compromise.

[Mitigation] Immediately apply the September 2026 or later Android security patches (2026-09-01).

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component

[Impact] Unauthorized remote attackers can bypass security warnings to perform network-based spoofing, potentially leading to credential harvesting or malware delivery

[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] Applications and system components utilizing the MSHTML (Trident) engine within Microsoft Windows environments

[Impact] Unauthorized network attackers can bypass critical security boundaries and sandbox protections, potentially leading to remote code execution

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or implement registry-based workarounds to restrict MSHTML rendering

[Affected Scope] Windows Shell component across Microsoft Windows operating systems

[Impact] Unauthorized network attackers can bypass critical security boundaries, potentially leading to arbitrary code execution via user interaction

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] All SolarWinds Web Help Desk (WHD) versions prior to 2026.1.

[Impact] Unauthenticated remote attackers can bypass internal security controls, gaining unauthorized access to restricted functionalities and sensitive data.

[Mitigation] Immediately upgrade to the latest secure version (2026.1 or higher) and restrict external access until patched.

[Affected Scope] All unpatched installations of 7-Zip software

[Impact] When extracting files from a crafted archive, the Mark-of-the-Web (MotW) is not propagated, allowing arbitrary code execution under the current user context without security warnings

[Mitigation] Immediately upgrade 7-Zip to the latest patched version and monitor unpatched endpoint assets

[Affected Scope] Microsoft Publisher 2016, Office LTSC 2021, and Microsoft 365 Apps within supported lifecycles

[Impact] An attacker can bypass Office macro block policies and Mark of the Web (MOTW) security warnings to execute arbitrary code when a user opens a specially crafted Publisher file

[Mitigation] Apply the official Microsoft security updates immediately and enforce Group Policies to block macros in files originating from the Internet

[Affected Scope] Windows 10, Windows 11, and Windows Server environments with Smart App Control or Windows Defender SmartScreen enabled

[Impact] Attackers can bypass Mark of the Web (MotW) warnings, allowing malicious files to execute without triggering security prompts to the user

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the execution of untrusted container/shortcut files

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass Mark of the Web (MotW) security warnings, leading users to execute malicious files without any security prompts

[Mitigation] Apply the official Microsoft security updates immediately and harden SmartScreen policies

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server utilizing Microsoft Defender SmartScreen

[Impact] Attackers can bypass Mark-of-the-Web (MotW) warnings and SmartScreen prompts entirely, leading to arbitrary code execution when a user opens a crafted malicious file

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict the execution of unverified downloaded files via Group Policy

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass Windows Defender SmartScreen warnings using crafted Internet Shortcut (.url) files to execute arbitrary code

[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] Jenkins Pipeline: Groovy Plugin 2.63 and earlier

[Impact] Attackers with pipeline script control can bypass the Groovy sandbox to execute arbitrary code on the Jenkins master JVM

[Mitigation] Immediately upgrade Jenkins Pipeline: Groovy Plugin to version 2.64 or later

[Affected Scope] Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update 45 and earlier, and OpenJDK 7.

[Impact] Remote attackers can completely bypass the Java security sandbox and execute arbitrary code on the host system via malicious 2D image rendering.

[Mitigation] Immediately upgrade to Java SE 7u25 or later, apply OpenJDK security patches, and disable Java browser plugins.

[Affected Scope] Oracle Java SE 7 through Update 11, and OpenJDK 7.

[Impact] Remote attackers can bypass the Java security sandbox and execute arbitrary code with elevated privileges.

[Mitigation] Apply the latest Java SE/OpenJDK security updates and disable Java browser plugins immediately.