CVE-2026-70148
Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
CVSS
6.5
Média
EPSS
0.4%
p34
KEV
—
Exploit Today
10
0-100
Publicado: 13 de out. de 2026 · Última mod.: 28 de out. de 2026 · CWE-441
0.4%EPSS · 30 dias0.4%
2026-10-142026-11-06
Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-889835.0 MÉD9.8%
——3Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.8hCVE-2026-1211988.8 ALT12.1%
——4Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)1dCVE-2026-1211718.8 ALT15.4%
——5Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)14hCVE-2026-1211088.8 ALT17.7%
——5Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)2dCVE-2026-499067.8 ALT2.5%
——1An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.4dCVE-2026-499035.3 MÉD3.7%
——1The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.12h