Base de CVEs

CVE-2026-0021 Alta · 8.4 CWE-441 02/03/2026

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible…

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0013 Alta · 8.4 CWE-441 02/03/2026

In setupLayout of PickActivity.java, there is a possible way to start any activity as a…

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0008 Alta · 8.4 CWE-441 02/03/2026

In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to…

In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48646 Alta · 7.8 CWE-441 02/03/2026

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a…

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2025-48579 Alta · 8.4 CWE-441 02/03/2026

In multiple functions of MediaProvider.java, there is a possible external storage write…

In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-31313 Alta · 7.2 CWE-441 12/02/2026

An unintended proxy or intermediary in the AMD power management firmware (PMFW) could…

An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system management unit (SMU) potentially resulting in arbitrary code execution.

CVE-2026-24471 Crítica · 9.3 CWE-441 02/02/2026

Homeserver Matrix continuwuity: assinatura de eventos arbitrários por servidor remoto malicioso

continuwuity é um homeserver Matrix escrito em Rust. Esta vulnerabilidade permite que um atacante com um servidor remoto malicioso faça com que o servidor local assine um evento arbitrário mediante interação do usuário. Quando uma conta de usuário deixa uma sala (rejeitando um convite), entra em uma sala ou solicita entrada em uma sala (knock), o servidor vítima pode pedir assistência a um servidor remoto. Se a vítima pedir assistência ao servidor do atacante, o atacante pode fornecer um evento arbitrário, que a vítima assinará e devolverá ao atacante. Para o endpoint /leave, isso funciona para qualquer evento com uma versão de sala suportada, em que origin e origin_server_ts são definidos pela vítima. Para o endpoint /join, é necessário um campo content definido pela vítima no formato de membership de join. Para o endpoint /knock, é necessário um campo content adicional definido pela vítima no formato de membership de knock e uma versão de sala que não esteja entre 1 e 6. Isso foi explorado como parte de uma cadeia maior contra o homeserver continuwuity.org. Esta vulnerabilidade afeta todos os servidores derivados do Conduit. Esta vulnerabilidade está corrigida no Continuwuity 0.5.1, Conduit 0.10.11, Grapevine 0aae932b e Tuwunel 1.4.9.

CVE-2026-24470 Alta · 8.1 CWE-441 26/01/2026

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

CVE-2025-64125 Crítica · 9.4 CWE-441 02/01/2026

Nuvation Energy nCloud Client-to-Client Communication

A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue.

CVE-2025-64123 Crítica · 9.8 CWE-441 02/01/2026

Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access

Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1.

CVE-2025-68944 Média · 5.3 CWE-441 26/12/2025

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access…

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

CVE-2025-11393 Alta · 8.7 CWE-441 15/12/2025

Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.

CVE-2025-36889 Média · 5.5 CWE-441 11/12/2025

In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a…

In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48628 Alta · 7.8 CWE-441 08/12/2025

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user…

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48586 Alta · 7.8 CWE-441 08/12/2025

In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak…

In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48555 Alta · 7.8 CWE-441 08/12/2025

In multiple functions of NotificationStation.java, there is a possible cross-profile…

In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48536 Alta · 7.8 CWE-441 08/12/2025

In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible…

In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22420 Alta · 7.8 CWE-441 08/12/2025

In multiple locations, there is a possible way to leak audio files across user profiles…

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-66415 Média · 5.4 CWE-441 01/12/2025

fastify-reply-from bypass of reply forwarding

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.