By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

1713 published vulnerabilities · page 9 of 18

• CVE-2026-45654HIGH 7.9

  Windows Secure Boot, a critical firmware-level security mechanism, contains an access control flaw that allows a high-privileged local attacker to circumvent its protections. Secure Boot is designed to ensure that only trusted code runs during system startup; this vulnerability permits an authorized user with administrative or equivalent rights to bypass those protections, potentially allowing unsigned or malicious code to execute at boot time. The issue affects recent Windows 11 versions and Windows Server 2025.

• CVE-2026-47656HIGH 7.9

  CVE-2026-47656 is a high-severity vulnerability in the Windows Boot Manager that allows an attacker with administrator privileges to disable or circumvent a security protection mechanism on a local system. While the attacker must already have elevated permissions, once exploited, they can interfere with boot-level security controls—a critical concern because these controls are meant to prevent unauthorized system modifications. This is not currently listed as actively exploited in the wild, but it warrants prompt patching given the scope of affected Windows versions.

• CVE-2026-48568HIGH 7.9

  CVE-2026-48568 is a high-severity vulnerability in Windows Secure Boot that allows a user with administrator or higher privileges to bypass a key security mechanism on their local system. Secure Boot is designed to prevent unauthorized code from running during system startup. This flaw breaks that protection, potentially enabling an attacker with elevated local access to load malicious code earlier in the boot process than normal security controls would permit. The vulnerability affects a broad range of Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025.

• CVE-2026-48570HIGH 7.9

  A flaw in Windows Secure Boot allows a high-privileged local attacker to disable or circumvent this critical platform security feature. Secure Boot is designed to prevent unauthorized code from running during system startup; this vulnerability defeats that protection. The attacker needs administrative or system-level access to exploit it, and the impact spans confidentiality and integrity of the entire system. This is not currently known to be exploited in the wild, but it represents a significant risk for any environment where an insider or compromised administrator poses a threat.

• CVE-2026-48573HIGH 7.9

  A vulnerability in Windows Secure Boot allows someone with high-level local access to bypass a key security feature that prevents unauthorized code from running during system startup. The flaw affects multiple versions of Windows 10, Windows 11, and Windows Server. While an attacker needs elevated privileges to exploit it, successful exploitation could allow them to circumvent protections that are meant to ensure only trusted software loads at boot time.

• CVE-2026-48575HIGH 7.9

  Windows Secure Boot, a critical firmware security feature designed to prevent unauthorized code execution during system startup, contains a protection mechanism failure that an authorized attacker can exploit locally. An attacker with administrative privileges can bypass Secure Boot controls, potentially allowing them to load unauthorized code at the lowest system level. The vulnerability affects multiple versions of Windows 10 and Windows 11, as well as Windows Server editions spanning 2012 through 2025.

• CVE-2026-48576HIGH 7.9

  CVE-2026-48576 is a high-severity security flaw in Windows Secure Boot that allows an authorized attacker with elevated privileges to bypass a critical security feature on local systems. Secure Boot is a foundational Windows security mechanism designed to prevent unauthorized code from executing during system startup. This vulnerability undermines that protection, potentially enabling an attacker to load unsigned or malicious firmware or bootloaders. The threat requires the attacker to already have administrative or system-level access, limiting the immediate attack surface, but the ability to circumvent Secure Boot represents a significant escalation once that initial access is obtained.

• CVE-2026-48578HIGH 7.9

  CVE-2026-48578 is a privilege escalation flaw in Windows Secure Boot affecting Windows 10 and 11 across multiple versions, as well as Windows Server 2012 through 2025. An attacker who already has administrative credentials on a system can exploit improper access controls to gain elevated privileges, potentially affecting system integrity and confidentiality. The vulnerability requires the attacker to be locally present and authenticated, but does not require user interaction to exploit. This is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

• CVE-2022-49036HIGH 7.8

  Synology Active Backup for Business Recovery Media Creator versions prior to 2.5.0-2081 contain a flaw where untrusted OpenSSL configuration can be loaded during operation. A local user with standard privileges can exploit this to execute arbitrary code on the system. The vulnerability stems from the application trusting configuration from a location or source that should not be trusted, creating a path for privilege escalation or lateral movement within an affected environment.

• CVE-2022-49042HIGH 7.8

  Synology Hyper Backup Explorer contains a vulnerability that allows authenticated local users to execute arbitrary code through a flaw in how the MinGW DLL component handles untrusted libraries or code. An attacker with local access to a system running vulnerable versions can leverage this weakness to run malicious code with the privileges of the user running the application, potentially compromising data or system integrity.

• CVE-2025-12694HIGH 7.8

  A flaw in Forcepoint VPN Client for Windows allows any logged-in user without administrator rights to gain full system-level (SYSTEM) access. An attacker with a regular user account can exploit this locally to take complete control of the machine. The vulnerability affects VPN Client version 6.11.3 and all earlier versions.

• CVE-2025-14098HIGH 7.8

  Avira Antivirus contains a critical flaw in its scanning engine that can be triggered when examining a specially crafted MS-DOS executable file. The vulnerability stems from an integer overflow that causes the engine to write data beyond the bounds of a heap buffer. An attacker can exploit this by tricking a user into scanning a malicious file, potentially leading to arbitrary code execution with the privileges of the antivirus process or crashing the antivirus engine entirely. This affects Windows, macOS, and Linux installations.

• CVE-2025-22424HIGH 7.8

  A vulnerability in Android allows a user with local access to view images that should be restricted to other users. The flaw stems from insufficient validation of user input across multiple code locations. While this requires someone already on the device and user interaction to exploit, it can lead to privilege escalation, meaning an attacker could gain elevated access to sensitive data and system resources.

• CVE-2025-22426HIGH 7.8

  CVE-2025-22426 is a privilege escalation vulnerability in Android's ComputerEngine component that allows a local attacker with basic user-level access to bypass security boundaries and access resources (URIs) belonging to other users on the same device. The flaw stems from a logic error in multiple functions within ComputerEngine.java that fails to properly enforce cross-user access controls. An attacker needs only local access to the device and their own user account—no special permissions or user interaction required—making this a straightforward path to elevated privileges.

• CVE-2025-26418HIGH 7.8

  A vulnerability in Android's device management system allows a local attacker with basic app permissions to bypass the user confirmation dialog that normally protects account additions on managed devices. This enables privilege escalation without requiring any special system access or user interaction. The flaw stems from a missing permission check in the CarDevicePolicyService component.

• CVE-2025-31272HIGH 7.8

  A vulnerability in macOS allows locally authenticated applications to circumvent built-in launch constraint protections—security mechanisms designed to prevent unauthorized code execution. An attacker with local access could potentially run malicious code with elevated system privileges by exploiting a weakness in how these protections are enforced. Apple has patched this issue in macOS Sequoia 15.4 with stricter validation checks.

• CVE-2025-32348HIGH 7.8

  CVE-2025-32348 is a privilege escalation vulnerability affecting Android that allows a local attacker to launch background activities without proper permission validation. An attacker with basic user-level access can exploit this flaw to gain elevated privileges on the device—no special capabilities or user interaction required. The vulnerability exists across multiple code paths where permission checks are missing, creating a consistent attack surface.

• CVE-2025-41278HIGH 7.8

  A memory read vulnerability exists in Waterfall Security's WF-500 RX Host (version 7.10.0.0 R2601141040) that allows an attacker with access to the TX Host to execute arbitrary code. The flaw stems from improper memory access controls, enabling an authenticated insider to move laterally within the Waterfall appliance and gain control of the receive-side components. This is a serious concern for organizations using Waterfall's unidirectional security gateways, as it undermines the trust boundary between the TX and RX sides of the architecture.

• CVE-2025-41280HIGH 7.8

  Waterfall Security's WF-500 RX Host contains a path traversal vulnerability (Zip Slip) that allows attackers who have already gained access to the TX Host to execute arbitrary code on the RX Host, provided MySQL connector functionality is configured and file compression is enabled. The vulnerability stems from improper handling of file paths during decompression operations, enabling attackers to write files outside their intended directory. This is a privilege escalation concern within an already-compromised environment rather than an initial access vector.

• CVE-2025-41281HIGH 7.8

  Nozomi Networks Labs discovered a code execution vulnerability in Waterfall's WF-500 RX Host that allows attackers already inside a network to run arbitrary commands. The vulnerability is triggered when a MySQL connector is configured and an attacker with access to the connected TX Host sends malicious input. This is a local privilege escalation scenario where internal network access is the prerequisite for exploitation.

• CVE-2025-48570HIGH 7.8

  A vulnerability in Android's PipTaskOrganizer component allows a malicious application with basic system privileges to launch activities from the background without user interaction. An attacker exploiting this flaw could escalate their privileges within the system, potentially gaining access to sensitive functionality or data. The vulnerability stems from a confused deputy issue—where a trusted system component is tricked into performing privileged actions on behalf of an unprivileged attacker.

• CVE-2025-48649HIGH 7.8

  CVE-2025-48649 is a local privilege escalation vulnerability affecting Google Android in which an attacker with limited user privileges can reset user-selected permission settings, effectively bypassing the permissions model that Android uses to protect sensitive device capabilities. Because no additional privileges are needed and user interaction is not required, any application with basic local access can trigger this issue to gain unauthorized access to protected device functions—a significant departure from Android's intended permission architecture.

• CVE-2025-48652HIGH 7.8

  A logic flaw in Android's application installation validation code allows a local attacker to bypass Mobile Device Management (MDM) security policies. An attacker with local access to the device can exploit this vulnerability to gain elevated privileges without requiring additional permissions or user interaction. MDM policies are a key security control for organizations managing corporate Android devices, making this bypass a significant concern for enterprise environments.

• CVE-2025-59604HIGH 7.8

  CVE-2025-59604 is a memory corruption vulnerability affecting Qualcomm Snapdragon processors across multiple generations. The flaw occurs during memory copy operations when a null pointer is dereferenced, causing invalid writes to memory. An attacker with local access to a device can exploit this to gain elevated privileges and potentially read or modify sensitive data. The vulnerability is rated HIGH severity and requires local execution context, meaning an attacker must already have a foothold on the device.

• CVE-2025-59605HIGH 7.8

  CVE-2025-59605 is a memory corruption flaw affecting Qualcomm wireless and networking chipsets. When a device processes identifier strings longer than designed, the software fails to properly validate input length, allowing the overflow to corrupt adjacent memory regions. An attacker with local access and standard user privileges can exploit this to read sensitive data, modify system behavior, or crash the device. The vulnerability requires direct local access and cannot be exploited remotely.

• CVE-2025-59606HIGH 7.8

  CVE-2025-59606 is a memory corruption vulnerability affecting multiple Qualcomm chipsets and wireless components. The flaw occurs when a device exhausts heap memory during secure data initialization, causing the firmware to write to invalid memory locations. An attacker with local access and limited privileges can exploit this to crash the system or potentially execute code with elevated permissions. This is a local privilege escalation risk rather than a remote attack vector.

• CVE-2025-7002HIGH 7.8

  Avira Antivirus contains a vulnerability in its scanning engine that triggers when processing a specially crafted PDF file. The flaw allows an attacker to read data from memory locations outside the intended buffer, potentially leading to either arbitrary code execution on the infected system or a crash of the antivirus engine itself. This is a local attack—the malformed PDF must reach the scanner on a user's machine, typically via email, web download, or file share. The vulnerability affects Windows, macOS, and Linux installations running engine versions prior to 8.3.70.68.

• CVE-2025-7003HIGH 7.8

  Avira Antivirus contains a flaw in its scanning engine that can crash or potentially allow code execution when it processes a specially crafted PDF file. The vulnerability exists in how the engine allocates and reads memory while parsing malformed PDF content. Any user on a Windows, macOS, or Linux system running an affected version of Avira could trigger this by opening or scanning a malicious PDF, even without administrator privileges. The issue affects all Avira Antivirus builds before version 8.3.70.56.

• CVE-2025-7004HIGH 7.8

  A heap buffer overflow flaw exists in multiple antivirus products from Gen Digital (Avast, AVG, and Norton) across Windows, macOS, and Linux. When the antivirus engine scans a deliberately malformed Windows PE (executable) file, it can write data beyond allocated memory boundaries. An attacker who can trick a user into opening a malicious file on a system running vulnerable antivirus software could either crash the antivirus process entirely or, in some cases, execute arbitrary code with the privileges of that process. The vulnerability is resolved through an automatic virus definition update; once your antivirus definitions reach build VPS 25040308 or later, you are protected regardless of which Gen Digital product you use.

• CVE-2025-7008HIGH 7.8

  Avast and its sister antivirus products (AVG, Norton, Avast One, and Avast Business) contain a memory safety flaw in their scanning engine that can be triggered by a specially crafted Windows executable file. When the antivirus scans such a file, it may read memory outside the intended buffer, potentially allowing an attacker with local access to execute code or crash the antivirus process itself. The vulnerability exists in the engine's handling of .NET metadata within PE files and is distributed across multiple consumer and business antivirus products via a shared Gen Digital virus definition update. The good news: updating virus definitions to build 25021310 or later eliminates the risk, regardless of which Gen Digital product you're running.

• CVE-2025-7011HIGH 7.8

  A heap memory error in antivirus software from Avast, AVG, Norton, and related Gen Digital products can cause the antivirus to crash or potentially execute code when scanning specially crafted zip files containing malformed XML. The vulnerability affects Windows, macOS, and Linux systems running older virus definition builds. Users are vulnerable only if their antivirus definitions are outdated; installing the patched definition build resolves the issue across all affected products that share this scanning engine.

• CVE-2025-7017HIGH 7.8

  A flaw in Avira's antivirus scanning engine allows a specially crafted Windows installer (MSI) file to trigger a memory corruption issue. When scanned, this malformed file can crash the antivirus process or potentially enable an attacker to execute code with the privileges of the antivirus engine—typically system-level on Windows. The vulnerability requires user interaction (opening or scanning the malicious file) but no special privileges to exploit.

• CVE-2025-9032HIGH 7.8

  Avira Antivirus contains a memory safety flaw that triggers when the scanning engine processes a specially crafted Windows executable file. An attacker who tricks a user into opening a malformed PE file can crash the antivirus process or potentially execute code with the privileges of the user running the scanner. The vulnerability affects Windows, macOS, and Linux systems running older Avira engine builds.

• CVE-2026-0009HIGH 7.8

  A logic error in Android allows a local attacker to hijack touch input through tapjacking attacks, potentially gaining elevated privileges on the device. No special permissions or user interaction are required for exploitation, making this a direct path to privilege escalation for any app already running on the compromised system.

• CVE-2026-0036HIGH 7.8

  CVE-2026-0036 is a tapjacking vulnerability in Android's StageCoordinator animation handler that allows a malicious app to escalate privileges without requiring user interaction or special permissions. An attacker with a local account on the device can overlay transparent windows to intercept touch events or manipulate the animation state, gaining unauthorized access to sensitive device functions and data. The vulnerability affects multiple Android versions and is rated HIGH severity due to its direct path to privilege escalation.

• CVE-2026-0045HIGH 7.8

  A logic error in Android's Bluetooth RFCOMM connection handling allows a local attacker to bypass the bonding requirement for secure connections. An attacker with local access can escalate privileges without needing special permissions or user interaction, potentially gaining full control over sensitive device functions protected by Bluetooth pairing.

• CVE-2026-0072HIGH 7.8

  A missing permission check in Android's input method manager allows a local attacker with minimal privileges to escalate their access and take full control of the affected device. No user action is required to exploit this flaw, making it a practical risk in multi-user or compromised environments.

• CVE-2026-0076HIGH 7.8

  CVE-2026-0076 is a local privilege escalation vulnerability in Android's ResourceTypes.cpp component. An attacker with local access to a device can trigger an out-of-bounds memory read through a flawed bounds check in the validateNode function. Successful exploitation allows the attacker to escalate privileges without requiring additional permissions or user interaction, potentially gaining elevated system access.

• CVE-2026-0077HIGH 7.8

  CVE-2026-0077 is a privilege escalation vulnerability in Android's ActivityRecord component that allows a local attacker with limited user privileges to launch background applications and gain elevated system access. The flaw stems from a logic error in the resumeConfigurationDispatch function that fails to properly validate or constrain application launch permissions. No special privileges or user interaction are required for exploitation, making this a straightforward attack vector for any app running on an affected device.

• CVE-2026-0078HIGH 7.8

  A flaw in Android's device policy management system allows a local user to escalate their privileges by exploiting improper validation of proxy configuration settings. The vulnerability exists in how the system persists global proxy changes, creating a state mismatch that can be leveraged without requiring special permissions or user interaction. An attacker with basic local access can trigger the flaw to gain elevated system privileges.

• CVE-2026-0087HIGH 7.8

  A logic error in Android's domain verification service allows a local attacker to hijack app links associated with arbitrary applications. By exploiting this flaw, an attacker can redirect app links to malicious apps, potentially intercepting sensitive user actions or data. The vulnerability requires local access but no special permissions or user interaction, making it a meaningful escalation path on compromised or personally-owned devices.

• CVE-2026-0088HIGH 7.8

  A flaw in Android's certificate installer component allows a malicious app with basic system privileges to bypass security dialogs that normally protect sensitive operations. By exploiting misleading UI presentation, an attacker can escalate their permissions without user knowledge or interaction. The vulnerability is particularly dangerous because it requires no special execution rights—a standard app can trigger it.

• CVE-2026-0089HIGH 7.8

  CVE-2026-0089 is a vulnerability in Android's PackageInstallerService that allows a local attacker with basic user-level permissions to bypass security checks and install applications without proper verification. Because the vulnerability exists in multiple functions that lack proper permission validation, an attacker can escalate their privileges by sidestepping the normal app installation safeguards. No user interaction or special device access is required to exploit this flaw once an attacker has obtained standard user privileges on the device.

• CVE-2026-0091HIGH 7.8

  A privilege escalation vulnerability exists in Android where an over-privileged shell user can execute arbitrary code within the launcher process. An attacker with local access can exploit this weakness to gain elevated privileges without needing special execution rights or user interaction. This is a local-only threat that targets the core launcher functionality central to Android's user interface and app management.

• CVE-2026-0093HIGH 7.8

  CVE-2026-0093 is a local privilege escalation vulnerability affecting Google Android. The flaw stems from misleading user interface elements that obscure the true nature of certain operations, potentially tricking users into granting elevated permissions. An attacker with local access to the device can exploit this weakness to escalate privileges without needing special system permissions beforehand, and notably, without requiring any user interaction during the actual exploitation phase. The vulnerability allows an attacker to read, modify, or delete sensitive data and potentially take control of affected system functions.

• CVE-2026-0094HIGH 7.8

  A flaw in Android's KeyChain component allows a local attacker with user-level privileges to manipulate the certificate approval interface in a way that tricks the system into granting access to certificates without explicit user consent. The vulnerability stems from misleading or incomplete UI messaging in the getApplicationLabel function, enabling privilege escalation entirely through local interaction. No special permissions or user action is required to exploit it once initiated.

• CVE-2026-0096HIGH 7.8

  CVE-2026-0096 is a local privilege escalation vulnerability in Android's ForgetDeviceDialogFragment that allows an attacker with local access to manipulate or bypass a device-forget confirmation flow due to misleading UI elements. The vulnerability requires no user interaction to exploit and can result in unauthorized privilege escalation on the affected device.

• CVE-2026-0098HIGH 7.8

  CVE-2026-0098 is a local privilege escalation vulnerability in Android's package-calling logic that allows a malicious app to bypass restrictions on which activities it can start. The flaw stems from a confused deputy problem—the system incorrectly trusts the calling context of an app requesting activity launches. An attacker with a local app installation can exploit this without special permissions or user interaction to gain elevated privileges, potentially accessing sensitive device functions or data reserved for system components.

• CVE-2026-0099HIGH 7.8

  A vulnerability exists in Android's host emulation manager that allows a malicious app to launch activities (screen components) from the background without proper authorization. The flaw stems from a logic error in how the system validates binding requests. While an attacker needs to be a local user with some system access already, they can exploit this to gain elevated privileges on the device. The vulnerability requires user interaction to trigger—likely through social engineering or user action within a compromised app context.

• CVE-2026-0100HIGH 7.8

  A heap buffer overflow vulnerability exists in Android's resource loading code (LoadedArsc.cpp) that allows a local attacker with standard user privileges to write data beyond the intended buffer boundaries. This memory corruption can be exploited to gain elevated system privileges without requiring special permissions or user interaction, making it a serious local privilege escalation vector.

• CVE-2026-0271HIGH 7.8

  A privilege escalation vulnerability exists in Palo Alto Networks' Prisma Access Agent on Linux systems. An attacker with local access to an affected Linux device can exploit this flaw to gain elevated privileges and run code with higher permissions than their current account level. This capability is limited to Linux deployments; Windows, macOS, iOS, Android, and ChromeOS installations are unaffected.

• CVE-2026-10046HIGH 7.8

  Bitdefender Napoca is a bare-metal hypervisor—a foundational piece of virtualization software that runs directly on hardware. A vulnerability exists in how it handles a legacy BIOS memory lookup request (INT 0x15). When a guest operating system makes this request with specific register values, the hypervisor fails to check whether the destination memory address is valid, allowing data to be written beyond the allocated buffer. An attacker with access to a guest system can exploit this to write data into the hypervisor's internal memory, potentially compromising the entire virtualization layer. Importantly, Napoca is end-of-life and no longer receives vendor support.

• CVE-2026-10047HIGH 7.8

  Bitdefender's Napoca bare-metal hypervisor contains a memory safety flaw that allows a local attacker with limited privileges to write data beyond the boundaries of an internal memory buffer. By crafting specific processor register values, an attacker can overflow into the hypervisor's heap memory, potentially corrupting critical hypervisor state or executing arbitrary code. This vulnerability affects an end-of-life product that is no longer receiving security updates.

• CVE-2026-10118HIGH 7.8

  Poppler, a widely-used PDF rendering library, contains a vulnerability in its Splash graphics backend that allows attackers to execute arbitrary code or crash applications by delivering specially crafted PDF files. The flaw stems from an integer overflow in the tiling pattern fill function—a feature used to render repeating graphical patterns in PDFs. When an attacker-controlled integer value overflows during this calculation, it causes the library to allocate insufficient heap memory. This undersized buffer is then written to beyond its boundaries, corrupting adjacent memory and potentially enabling code execution.

• CVE-2026-10847HIGH 7.8

  Check Point Identity Agent Full for Windows contains a local privilege escalation flaw that allows an authenticated user already logged into a Windows machine to run code with SYSTEM-level permissions. The vulnerability stems from how the application resolves executables during its log collection process. An attacker with regular user access could exploit this to gain complete control over the affected endpoint.

• CVE-2026-10942HIGH 7.8

  Google Chrome on Windows contains a UI implementation flaw that allows a local attacker to escalate privileges by opening a malicious file. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (opening a file) but no authentication. If exploited, an attacker could gain elevated system privileges on an affected machine.

• CVE-2026-11072HIGH 7.8

  A use-after-free flaw in Chrome's WebView component on Android allows a local attacker to run malicious code if a user opens a specially crafted file. The attacker needs physical or local access to the device and requires user interaction (opening the file), but once triggered, can gain full control over the affected application's privileges and data.

• CVE-2026-11103HIGH 7.8

  A flaw in Google Chrome's installer on Windows allows a local attacker to gain administrative privileges on a computer by tricking a user into opening a malicious file. The vulnerability exists in how the installer validates and processes files during installation or updates. While Chrome itself is a web browser, this weakness targets the installation mechanism—the software that sets up Chrome on your system—making it a local privilege escalation risk rather than a remote internet-based attack.

• CVE-2026-11332HIGH 7.8

  A vulnerability in ansible-core allows attackers to execute arbitrary code on systems where users install malicious Ansible roles. The attack works by embedding hidden git commands in a role's dependency specification file. When a user runs the standard ansible-galaxy role install command to fetch a role, the injected git flags execute with the privileges of that user, potentially giving an attacker full control over the victim's machine.

• CVE-2026-11822HIGH 7.8

  SQLite versions prior to 3.53.2 contain memory safety flaws in the FTS5 full-text search module. When a user opens a specially crafted database file and runs a full-text search query, the vulnerability can trigger memory corruption that crashes the application, exhausts available memory, or potentially allows code execution. The vulnerability requires user interaction—a victim must open the malicious database—but once triggered, the impact is severe.

• CVE-2026-11824HIGH 7.8

  SQLite versions before 3.53.2 contain a critical flaw in their full-text search capability that can be exploited by opening a specially crafted database file. When an application uses the FTS5 feature and processes search queries against the malicious database, attackers can trigger a memory corruption issue that crashes the application or potentially executes code with the privileges of the user running SQLite. The vulnerability requires local access and user interaction (opening a file), but poses significant risk to applications that accept untrusted database files.

• CVE-2026-12191HIGH 7.8

  A flaw in Comma AI's Openpilot version 0.11 allows a local attacker with basic user privileges to execute arbitrary code through unsafe deserialization of pickle files. The vulnerability exists in the model data loading component and requires an attacker to already have access to the system where Openpilot is running. While the attack surface is limited to local access, the impact is severe—an attacker can read, modify, or delete sensitive data, and compromise the integrity of the autonomous driving system.

• CVE-2026-12193HIGH 7.8

  VS Revo RevoUninstaller versions 2.5.x and 2.6.x contain a heap-based buffer overflow flaw in the RevoDetector.sys driver's IOCTL handler. A local attacker with standard user privileges can exploit this to crash the system or potentially execute code with elevated privileges. The vulnerability requires local access and cannot be exploited remotely. A public exploit exists, elevating the practical risk. Upgrading to version 2.7.0 eliminates the vulnerability.

• CVE-2026-12214HIGH 7.8

  Qihoo 360 Total Security version 6.0 contains a vulnerability in its Nucleus Engine Monitoring Logic that allows a local attacker with regular user privileges to bypass security protections by manipulating how the system handles network address parameters. This flaw has been publicly disclosed with working exploit code available, creating immediate risk for organizations running this software.

• CVE-2026-12217HIGH 7.8

  DVDFab Virtual Drive version 2.0.0.5 contains a privilege escalation vulnerability in its signed kernel driver component (dvdfabio.sys). A local user with standard privileges can exploit this flaw to gain elevated system access, potentially allowing them to modify system files, install malware, or disable security controls. The vulnerability requires local access and user interaction is not needed once code execution begins. Public exploit code is available, increasing the urgency for affected organizations.

• CVE-2026-20455HIGH 7.8

  CVE-2026-20455 is a local privilege escalation vulnerability in MediaTek's geniezone component affecting a wide range of SoC firmware versions. An attacker who already holds system-level privileges can exploit a missing bounds check in memory write operations to escalate their access further. The vulnerability requires no user interaction and impacts dozens of MediaTek chipset families used in Android devices and embedded systems.

• CVE-2026-2049HIGH 7.8

  GIMP contains a heap buffer overflow vulnerability in its HDR file parser that can lead to remote code execution. When a user opens a malicious HDR file or is tricked into visiting a compromised page hosting one, an attacker can overflow a memory buffer and execute arbitrary code with the privileges of the user running GIMP. The vulnerability requires user interaction but poses significant risk to creative professionals and any organization using GIMP for image processing workflows.

• CVE-2026-21029HIGH 7.8

  A flaw in Samsung's Galaxy Editing Service allows a local attacker with basic user privileges to gain elevated access and control on affected devices. The vulnerability stems from improper export of application components, meaning internal functions that should remain private are exposed to other apps. An attacker already with local access can exploit this to perform privileged operations without needing to trick a user or rely on any special conditions. This is fixed in the June 2026 Samsung Monthly Security Release (SMR).

• CVE-2026-21030HIGH 7.8

  A flaw in MediaTek's Audio Hardware Abstraction Layer (HAL) component fails to properly restrict access to audio-related privileged functions. An attacker with local access to an affected device can bypass these controls and execute operations that should require higher permissions. This vulnerability affects Samsung Android devices and requires the attacker to already have some level of access to the device, but once exploited, grants significant control over the audio system and potentially other sensitive device functions.

• CVE-2026-21031HIGH 7.8

  AppBlock, a Samsung Android security component, contains an authorization flaw that allows a local attacker to launch arbitrary activity on an affected device. The vulnerability requires user interaction to trigger—for example, the user must perform an action or accept a prompt that inadvertently enables the attack. While the flaw is local-only (not remotely exploitable), it grants the attacker significant control over the device once activated.

• CVE-2026-22926HIGH 7.8

  Omnissa Workspace ONE Assist for macOS contains a local privilege escalation vulnerability that allows an authenticated user with standard privileges to gain elevated system access. An attacker already present on a macOS system could exploit this flaw to escalate their permissions without requiring user interaction, potentially compromising the entire system and its data.

• CVE-2026-24064HIGH 7.8

  Waves Central for macOS has a serious local privilege escalation flaw in versions 13.0.9 through 16.5.5. An attacker with access to a user account on an affected Mac can inject malicious code into a trusted Waves process by manipulating how the system loads libraries, then escalate to root privileges. This vulnerability is fixed in version 16.6.2 and should be treated as urgent by any organization running Waves audio production software on macOS.

• CVE-2026-24221HIGH 7.8

  NVIDIA's NVTabular library contains a deserialization vulnerability that could allow an authenticated attacker to execute arbitrary code, modify data, or steal sensitive information. The vulnerability is rated HIGH severity and requires local system access and valid user credentials to exploit. While not currently listed as actively exploited, this flaw merits prompt attention given the potential for code execution on systems processing sensitive machine learning datasets.

• CVE-2026-24237HIGH 7.8

  NVIDIA NVTabular is vulnerable to unsafe deserialization of untrusted data. An attacker with local access and basic user privileges could exploit this flaw to execute arbitrary code, modify data, or steal sensitive information from systems running the affected software.

• CVE-2026-25260HIGH 7.8

  A memory corruption vulnerability in Qualcomm firmware and associated devices allows a local, authenticated attacker to corrupt memory by modifying shared buffers concurrently without the system validating those changes. This is a time-of-check-time-of-use (TOCTOU) style flaw where kernel or firmware code assumes a buffer's contents remain unchanged, but a malicious user-mode process modifies it between the check and actual use. The vulnerability requires local access and valid credentials but can lead to complete system compromise.

• CVE-2026-25551HIGH 7.8

  Seagull Software BarTender versions 2021 R1 through 12.0.1 contain a flaw that allows local users with standard privileges to gain system-level access. The vulnerability stems from how BarTender's system service handles incoming network requests—it trusts serialized data without proper validation, allowing an attacker to craft malicious requests that execute code with the highest Windows privileges. Because the vulnerable service only listens on the local machine, an attacker must already have a local user account to exploit it, but once inside, they can escalate to full system control.

• CVE-2026-27788HIGH 7.8

  ServerView Agents for Windows versions up to 11.60.04 contain a privilege escalation vulnerability rooted in improper file or resource permissions. Any local user with valid credentials on the affected server can exploit this flaw to gain SYSTEM-level access, effectively taking complete control of the system. The vulnerability requires no user interaction and affects all Windows deployments running the vulnerable software versions.

• CVE-2026-28577HIGH 7.8

  A vulnerability in Android's window management system allows a locally authenticated attacker to perform a tapjacking attack—placing hidden overlay windows on top of legitimate applications to intercept user input or actions. This attack doesn't require user interaction to trigger and can result in unauthorized privilege escalation. The attacker needs only local access to the device (such as through an installed app), making it a practical threat in real-world scenarios.

• CVE-2026-28580HIGH 7.8

  CVE-2026-28580 is a local privilege escalation vulnerability affecting Google Android. An attacker with basic user-level access to a device can exploit an incorrect bounds check in multiple persistence-related functions to gain elevated privileges without requiring additional capabilities or interaction from the user. The issue stems from a synchronization problem that allows the attacker to manipulate persistent data in an unexpected way, ultimately escalating their permissions on the system.

• CVE-2026-32325HIGH 7.8

  ServerView Agents for Windows contains a privilege escalation flaw that allows an already-authenticated local user to gain SYSTEM-level access. This is not a remote attack—the attacker must have legitimate credentials and local login capability on the affected server. However, once inside, they can elevate to the highest privilege level, potentially taking full control of the system.

• CVE-2026-33828HIGH 7.8

  A security flaw in Windows Attestation allows an authorized user on a Windows system to bypass security boundaries and gain elevated privileges without requiring interaction or elevated starting permissions. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server. An attacker who already has local access to a system can exploit this to run code with higher privileges, potentially compromising the entire system.

• CVE-2026-34695HIGH 7.8

  Adobe InDesign versions 21.3, 20.5.3 and earlier contain a stack-based buffer overflow vulnerability that could allow an attacker to execute arbitrary code on a victim's computer. An attacker would need to trick a user into opening a malicious file—there is no remote exploitation vector. The vulnerability affects InDesign on both Windows and macOS systems.

• CVE-2026-34696HIGH 7.8

  Adobe InDesign versions 21.3, 20.5.3 and earlier contain a Use After Free memory vulnerability that allows attackers to execute arbitrary code on a user's computer. The flaw requires a user to open a specially crafted malicious file—there is no remote attack vector. Once triggered, an attacker gains full control of the application and can read, modify, or delete user data, install malware, or pivot to other systems with the privileges of the logged-in user.

• CVE-2026-34697HIGH 7.8

  Adobe InDesign Desktop has a stack-based buffer overflow flaw that allows attackers to run arbitrary code on your computer if you open a malicious file. The vulnerability affects InDesign version 21.3, 20.5.3, and earlier on both Windows and macOS. It requires user interaction—the attacker must trick you into opening a crafted document—but once triggered, the code runs with your user privileges. This is a serious issue because InDesign documents are commonly shared and trusted, making social engineering attacks plausible.

• CVE-2026-34698HIGH 7.8

  Adobe InDesign Desktop contains a memory handling flaw that allows attackers to execute arbitrary code on a user's computer if the user opens a specially crafted file. The vulnerability affects InDesign versions 21.3, 20.5.3 and earlier on both Windows and macOS systems. While the flaw is serious, exploiting it requires social engineering or file delivery—an attacker cannot trigger it remotely over the network.

• CVE-2026-34699HIGH 7.8

  Adobe InDesign Desktop contains a heap memory vulnerability that could allow an attacker to execute arbitrary code on a victim's computer. The flaw exists in versions 21.3, 20.5.3, and earlier on both Windows and macOS. An attacker would need to trick a user into opening a specially crafted file—such as an InDesign document—to trigger the vulnerability. If successful, the attacker gains the same permissions as the logged-in user, potentially enabling data theft, malware installation, or lateral movement within a network.

• CVE-2026-34700HIGH 7.8

  Adobe InDesign versions 21.3, 20.5.3 and earlier contain a memory vulnerability that allows an attacker to execute arbitrary code on a victim's computer. The attack requires social engineering—a user must be tricked into opening a malicious file. Once opened, the flaw allows the attacker to run code with the same privileges as the InDesign user, potentially compromising the entire system. This is a serious but not trivial threat: it requires user interaction and affects only specific InDesign versions, but the payoff for an attacker is significant.

• CVE-2026-34701HIGH 7.8

  Adobe InDesign Desktop has a memory safety flaw that allows attackers to execute arbitrary code on a victim's machine by crafting a malicious document. When an unsuspecting user opens the file in InDesign 21.3, 20.5.3, or earlier versions, the vulnerability is triggered, giving the attacker the same privileges as the user running InDesign. This is a serious risk for design teams and publishers who regularly work with untrusted or externally-sourced documents.

• CVE-2026-34702HIGH 7.8

  Adobe InDesign versions 21.3, 20.5.3 and earlier contain a stack-based buffer overflow flaw that allows attackers to execute arbitrary code with the privileges of the user running InDesign. The vulnerability requires social engineering—an attacker must trick a user into opening a specially crafted file. Once opened, the malicious file triggers the overflow and grants the attacker code execution on the victim's machine. This affects both Windows and macOS deployments of InDesign.

• CVE-2026-34706HIGH 7.8

  Adobe InCopy, a professional editorial software tool, contains a vulnerability that allows attackers to execute malicious code on a user's system when the user opens a specially crafted file. The flaw stems from improper memory handling (out-of-bounds write) that can be exploited to gain full control of the affected system under the privileges of the logged-in user. Affected versions include InCopy 21.3, 20.5.3, and earlier releases. The attack requires social engineering—convincing a user to open a malicious document—but once successful, the impact is severe.

• CVE-2026-34707HIGH 7.8

  Adobe InCopy versions 21.3, 20.5.3 and earlier contain a memory safety flaw that allows attackers to execute arbitrary code on affected systems. The vulnerability is triggered when a user opens a specially crafted malicious file, making it a file-based attack vector that relies on social engineering or document distribution. The flaw exists in how InCopy handles memory allocation during file parsing, creating conditions where an attacker-controlled payload can overwrite adjacent heap memory and gain code execution privileges.

• CVE-2026-34708HIGH 7.8

  Adobe InCopy versions 21.3, 20.5.3 and earlier contain a stack-based buffer overflow flaw that could allow an attacker to execute arbitrary code with the privileges of the user running the application. The vulnerability requires an attacker to trick a user into opening a specially crafted malicious file, making it a user-interaction-dependent threat. InCopy is Adobe's collaborative editing companion to InDesign, widely used in publishing and design workflows, so this affects organizations relying on these tools for content creation and layout work.

• CVE-2026-34709HIGH 7.8

  Adobe Substance3D Sampler versions 6.0.0 and earlier contain a memory corruption flaw that could allow attackers to execute arbitrary code on a victim's computer. The vulnerability requires a user to open a specially crafted malicious file, making social engineering the primary attack vector. Once exploited, an attacker gains the same privileges as the logged-in user, potentially compromising sensitive design assets, credentials, or system access.

• CVE-2026-34710HIGH 7.8

  Adobe Substance3D Sampler versions 6.0.0 and earlier contain a flaw that allows attackers to execute arbitrary code on a user's computer. The vulnerability is triggered when a user opens a specially crafted malicious file in the application. Once the file is opened, an attacker gains the ability to run code with the same privileges as the logged-in user, potentially compromising design assets, stealing credentials, or pivoting to other systems on the network.

• CVE-2026-36574HIGH 7.8

  CactusViewer v2.3.0 contains a DLL hijacking vulnerability that allows an attacker to execute arbitrary code and escalate privileges on a system where the application is installed. The flaw occurs because the application loads dynamic libraries in an unsafe manner, enabling an attacker to place a malicious DLL in a location the application searches before legitimate system libraries. When CactusViewer runs, it loads the attacker's malicious code instead of the legitimate library, granting the attacker the same privilege level as the user running the application.

• CVE-2026-38950HIGH 7.8

  ESA AnomalyMatch versions before 1.3.1 contain a critical flaw that allows attackers with local system access to run malicious code by uploading specially crafted model checkpoint files. The vulnerability stems from the application's use of unsafe deserialization when loading PyTorch model files, which can execute arbitrary Python code during the loading process. An attacker who can place a malicious model file in the session directories—or trick a user into loading one—gains the ability to execute commands with the privileges of the AnomalyMatch process.

• CVE-2026-40290HIGH 7.8

  OP-TEE is a trusted execution environment that provides a secure processing space on Arm-based processors. A race condition in OP-TEE versions 3.16.0 through 4.10.x creates a use-after-free vulnerability in the shared memory management code. The vulnerability occurs when OP-TEE is configured to manage secure partitions (a specific operational mode). A local user could exploit this by timing concurrent operations on shared memory to cause the system to access memory that has already been freed, potentially compromising the confidentiality, integrity, or availability of the secure environment.

• CVE-2026-40404HIGH 7.8

  A flaw in Windows' Universal Disk Format (UDF) file system driver allows a logged-in user to gain elevated privileges on their machine. An attacker with basic user access can exploit a memory corruption issue in the UDFS driver to execute code with system-level permissions, potentially taking full control of the affected computer. This is a local-only vulnerability—attackers cannot exploit it remotely—but it represents a significant post-compromise escalation path and a serious risk in multi-tenant or shared-access environments.

• CVE-2026-40409HIGH 7.8

  A flaw in Windows' Universal Disk Format (UDF) file system driver allows a user with standard local access to gain elevated privileges on their machine. An attacker with a user account can craft specially formatted UDF media or manipulate UDF structures to trigger the vulnerability and execute code with system-level permissions. This is a local elevation-of-privilege issue—it requires prior access to the system but bypasses privilege boundaries to reach administrative capabilities.

• CVE-2026-40619HIGH 7.8

  A high-severity vulnerability in Genetec Security Center main server installations can allow an attacker who already has local access to the server's operating system to steal the Server Admin credentials. The unusual aspect of this vulnerability is that it affects specific installation builds rather than entire product versions—meaning two installations of the same version number could have different risk levels depending on which build was deployed. There is currently no public evidence that this flaw is being actively exploited in the wild.