Latest CVE Feed
-
7.8
HIGHCVE-2025-20706
In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS0992462... Read more
- Published: Sep. 01, 2025
- Modified: Sep. 03, 2025
- Vuln Type: Memory Corruption
-
7.8
HIGHCVE-2025-48535
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no ... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Misconfiguration
-
7.8
HIGHCVE-2024-49714
In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Memory Corruption
-
7.8
HIGHCVE-2024-49720
In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. ... Read more
Affected Products : android- Published: Sep. 02, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-22434
In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f... Read more
Affected Products : android- Published: Sep. 02, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-55582
D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `signalc` without verifying integrity, authenticity, or permissions. An attacker with local filesys... Read more
- Published: Aug. 27, 2025
- Modified: Sep. 09, 2025
- Vuln Type: Authentication
-
7.8
HIGHCVE-2025-48523
In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-48541
In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-21476
Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.... Read more
Affected Products : qca6391_firmware wcn6855_firmware wcn6856_firmware wcn7850_firmware wcn7851_firmware wcn6750_firmware qca6698aq_firmware qcm6490_firmware qcn9011_firmware qcn9012_firmware +74 more products- Published: Sep. 24, 2025
- Modified: Sep. 25, 2025
- Vuln Type: Memory Corruption
-
7.8
HIGHCVE-2025-8892
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.... Read more
Affected Products : 3ds_max autocad advance_steel autocad_architecture autocad_electrical autocad_map_3d autocad_mechanical autocad_mep autocad_plant_3d revit +6 more products- Published: Sep. 22, 2025
- Modified: Sep. 25, 2025
- Vuln Type: Memory Corruption
-
7.8
HIGHCVE-2025-36905
In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploita... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-36898
There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-54908
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.... Read more
Affected Products : office 365_apps powerpoint office_long_term_servicing_channel office_2024 office_2021 office_2019 powerpoint_2016- Published: Sep. 09, 2025
- Modified: Sep. 12, 2025
-
7.8
HIGHCVE-2025-32323
In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper input validation. This could lead to local escalation of privilege with no additional execution ... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Authentication
-
7.8
HIGHCVE-2025-49459
Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of privilege via local access.... Read more
Affected Products :- Published: Sep. 09, 2025
- Modified: Sep. 11, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-36903
In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Memory Corruption
-
7.8
HIGHCVE-2025-32312
In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additiona... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Information Disclosure
-
7.8
HIGHCVE-2025-55224
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.... Read more
Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 +1 more products- Published: Sep. 09, 2025
- Modified: Sep. 12, 2025
-
7.8
HIGHCVE-2025-26436
In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges nee... Read more
Affected Products : android- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Authorization
-
7.8
HIGHCVE-2025-54245
Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim m... Read more
Affected Products : substance_3d_viewer- Published: Sep. 09, 2025
- Modified: Sep. 12, 2025
- Vuln Type: Memory Corruption