CVE-2026-49785
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
CVSS
7.8
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-404
Not enough EPSS history yet.
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1091445.3 MED—
——0A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1091076.5 MED43.1%
——13A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.1dCVE-2026-1087694.3 MED37.4%
——11A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1086825.4 MED32.1%
——10A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1086814.3 MED37.4%
——11A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.20hCVE-2026-1085774.3 MED20.3%
——6A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.1d