Base de CVEs

CVE-2026-83837 Alta · 7.8 CWE-441 13/10/2026

Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability

Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

CVE-2026-70148 Média · 6.5 CWE-441 13/10/2026

Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

CVE-2026-93294 Média · 6.3 CWE-441 13/10/2026

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

CVE-2026-109373 Alta · 8.1 CWE-441 12/10/2026

ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

CVE-2026-102255 Crítica · 10.0 CWE-441 07/10/2026

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place…

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

CVE-2026-106487 Baixa · 3.5 CWE-441 06/10/2026

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

CVE-2026-106462 Média · 6.4 CWE-441 06/10/2026

Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

CVE-2026-94205 Crítica · 9.8 CWE-441 06/10/2026

Gitea fork workflow approval bypass through maintainer-triggered events

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.

CVE-2026-106427 Média · 5.4 CWE-441 06/10/2026

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a…

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106359 Média · 4.3 CWE-441 06/10/2026

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed...

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106326 Média · 4.4 CWE-441 06/10/2026

Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a…

Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

CVE-2026-106301 Alta · 8.1 CWE-441 06/10/2026

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a…

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106286 Média · 6.5 CWE-441 06/10/2026

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote…

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-106266 Média · 6.5 CWE-441 06/10/2026

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a…

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106228 Alta · 8.3 CWE-441 06/10/2026

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote…

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106221 Alta · 8.3 CWE-441 06/10/2026

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed…

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106188 Alta · 7.1 CWE-441 06/10/2026

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed…

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-55270 Alta · 7.8 CWE-441 05/10/2026

In dialInternal in multiple locations, there is a possible permission bypass due to a…

In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28648 Alta · 7.8 CWE-441 05/10/2026

In Settings, there is a possible permission bypass due to a confused deputy. This could…

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-93320 Média · 6.0 CWE-441 05/10/2026

BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

CVE-2026-95361 Média · 4.3 CWE-441 29/09/2026

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote…

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95328 Média · 6.5 CWE-441 29/09/2026

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed…

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

CVE-2026-101907 Alta · 7.0 CWE-441 28/09/2026

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until…

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.

CVE-2026-101905 Alta · 7.6 CWE-441 28/09/2026

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until…

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.

CVE-2026-72668 Alta · 7.3 CWE-441 26/09/2026

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder…

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.