CVE Watch12 ago 2026

CVE-2025-31938

Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 11 ago 2026 · Última mod.: 12 ago 2026 · CWE-1220

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

Referencias oficiales

intel.comhttps://intel.com/content/www/us/en/security-center/advisory/intel-sa-01404.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-688686.5 MED

—

——0The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.5h CVE-2026-627217.8 ALT

—

——0Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.12h CVE-2026-165605.3 MED

15.7%

——5A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.21d CVE-2026-505028.0 ALT

45.5%

——14Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.21d CVE-2026-504057.8 ALT

11.9%

——4Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.21d CVE-2026-561557.8 ALT

82.0%

KEV—75Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability 28d