Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-9871 | 7.8 high | 0.00% | razer, synapse | Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373. | 8 Oct |
| CVE-2026-118682 | 7.7 high | 0.00% | no CPE yet | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs. | Wed 28 Oct |
| CVE-2025-10089 | 7.7 high | 0.00% | no CPE yet | Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, and MILCO.S Easy Switch Application (IR) all versions allows a local attacker to execute malicious code by having installer to load a malicious DLL. However, if the signer name "Mitsubishi Electric Lighting" appears on the "Digital Signatures" tab of the properties for "MILCO.S Lighting Control.exe", the application is a fixed one. This vulnerability only affects when the installer is run, not after installation. If a user downloads directly from Mitsubishi Electric website and installs the affected product, there is no risk of malicious code being introduced. | 18 Oct |
| CVE-2026-108160 | 7.7 high | 0.00% | no CPE yet | AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user. | 9 Oct |
| CVE-2026-10696 | 7.5 high | 0.00% | devolutions, unigetui | Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update. | Mon 26 Oct |
| CVE-2026-92092 | 7.4 high | — | red hat, red hat openshift container platform 4, red hat openshift container platform 5 | A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution. | 9 h ago |
| CVE-2026-101295 | 7.3 high | — | red hat, assisted installer for red hat openshift container platform 2, red hat openshift container platform 4, red hat openshift container platform 5 | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory. | 16 h ago |
| CVE-2026-111582 | 7.3 high | 0.00% | no CPE yet | A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction. | Wed 28 Oct |
| CVE-2026-111583 | 7.3 high | 0.00% | no CPE yet | Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation. | Wed 28 Oct |
| CVE-2026-7539 | 7.3 high | 0.00% | no CPE yet | A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability. | Sun 25 Oct |
| CVE-2026-0392 | 7.3 high | 0.00% | no CPE yet | eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host. | 23 Oct |
| CVE-2025-11940 | 7.3 high | 0.00% | no CPE yet | A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component. | 19 Oct |
| CVE-2026-106581 | 7.3 high | 0.00% | no CPE yet | Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem. | 9 Oct |
| CVE-2025-57716 | 7.3 high | 0.00% | fortinet, forticlient | An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local low privileged user to perform a DLL hijacking attack via placing a malicious DLL to the FortiClient Online Installer installation folder. | 8 Oct |
| CVE-2024-14047 | 7.1 high | 0.00% | elastic, winlogbeat | A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service. | Tue 27 Oct |
| CVE-2026-44641 | 7.1 high | 0.00% | no CPE yet | Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12. | Mon 26 Oct |
| CVE-2026-61449 | 7.1 high | 0.00% | no CPE yet | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56. | Sat 24 Oct |
| CVE-2026-19589 | 7.1 high | 0.00% | no CPE yet | Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0. | 23 Oct |
| CVE-2026-69441 | 7.0 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2026-77894 | 7.0 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2026-62694 | 7.0 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2026-61938 | 7.0 high | 0.00% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-85941 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-87693 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-87704 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-87708 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-50490 | 7.0 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-48571 | 7.0 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-48572 | 7.0 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-88124 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-70272 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-85361 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-85364 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-108468 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-83899 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally. | 21 Oct |
| CVE-2026-83752 | 7.0 high | 0.00% | no CPE yet | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83718 | 7.0 high | 0.00% | no CPE yet | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83717 | 7.0 high | 0.00% | no CPE yet | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83702 | 7.0 high | 0.00% | no CPE yet | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83680 | 7.0 high | 0.00% | no CPE yet | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83676 | 7.0 high | 0.00% | no CPE yet | Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83775 | 7.0 high | 0.00% | no CPE yet | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-83708 | 7.0 high | 0.00% | no CPE yet | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-96307 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2026-96305 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2026-96302 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2026-88076 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2026-87715 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2026-4482 | 6.8 medium | 0.00% | rapid7, insight_agent | The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user. | Mon 26 Oct |
| CVE-2026-107578 | 6.7 medium | 0.00% | no CPE yet | Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run. | 8 Oct |
Download these 171 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.