CVE Watch29 jul 2026

CVE-2026-6102

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala

CVSS

7.8

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 29 jul 2026 · Última mod.: 29 jul 2026 · CWE-346

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NTIOLib_X64.sys driver. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28935.

Referencias oficiales

www.zerodayinitiative.comhttps://www.zerodayinitiative.com/advisories/ZDI-26-430/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-63118—

—

——0MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.16h CVE-2026-546057.2 ALT

3.2%

——1OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.2d CVE-2026-579897.4 ALT

36.0%

——11Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.3d CVE-2026-579785.4 MED

12.2%

——4Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.3d CVE-2026-167458.8 ALT

15.2%

——5A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.7d CVE-2026-133218.6 ALT

12.3%

——4The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.8d