| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network. |
| Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally. |
| Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network. |
| Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
| Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally. |
| Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. |
| Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally. |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. |
| Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
| Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally. |
| Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. |
| Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally. |
| Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally. |
| Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2. |
