CVE Watch10 de nov. de 2026

CVE-2026-60141

Improper null termination for some Intel(R) Metrics Discovery Application Programming Interface before version 1.16.189 within Ring 3: User

CVSS

—

Sem CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-170

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Improper null termination for some Intel(R) Metrics Discovery Application Programming Interface before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Referências oficiais

intel.comhttps://intel.com/content/www/us/en/security-center/advisory/intel-sa-01565.html

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1233887.8 ALT

—

——0Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.3h CVE-2026-1219434.8 MÉD

92.9%

——28Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.6d CVE-2026-571856.5 MÉD

41.6%

——12Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.11d CVE-2026-1144573.7 BAI

31.1%

——9A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.15d CVE-2026-968605.5 MÉD

33.1%

——10Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.13d CVE-2026-968505.5 MÉD

38.5%

——12Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.25d