| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally. |
| Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network. |
| Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
| Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally. |
| Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. |
| Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally. |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. |
| Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
| Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally. |
| Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. |
| Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally. |
| Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally. |
| Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2. |
| Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12. |
