CVE-2026-83798
Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.
CVSS
5.5
Média
EPSS
0.2%
p15
KEV
—
Exploit Today
5
0-100
Publicado: 13 de out. de 2026 · Última mod.: 27 de out. de 2026 · CWE-20 · CWE-347
0.2%EPSS · 30 dias0.2%
2026-10-142026-11-06
Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1187866.8 MÉD—
———Improper input validation in non-secure-callable (NSC)
veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example
(multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and
26.09.00 may allow a non-secure caller to supply unvalidated pointers and size
values, potentially resulting in disclosure of secure-world memory to the
non-secure domain, or denial of service. All software versions starting from
26.06.01-lts and 26.12.00-pvw1 have fixed this issue.7hCVE-2026-1187856.7 MÉD—
———Improper handling of non-secure-world input in NSC veneer
functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),
affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a
non-secure caller to supply unvalidated pointers or untrusted data, causing a
timing side-channel, TOCTOU condition, or format-string misuse, potentially
resulting in secure-world memory disclosure or denial of service. All software
versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.7hCVE-2026-1237917.3 ALT—
———A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.8hCVE-2026-857087.5 ALT—
———Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CB_SECRET, including known or shipped-default values in stock source and repository Docker Compose installs. The vulnerable surface is chart share-token verification and filter-access routes for private charts. An attacker who knows the deployment's CB_SECRET targets a private chart that has been shared at least once so a share-policy row exists, then forges a Chart-subject token for that chart id. The known signing key permits valid Chart tokens, and the filter-access path accepts sequential integer ids without requiring a legitimate share link; token expiry and revocation are ineffective once the secret is known. The condition requires a known or default secret and an existing share-policy row. A bare container where CB_SECRET is undefined is outside this path, and a unique secret excludes it only while the value remains unknown and unpredictable. An unauthenticated attacker can enumerate integer ids and read arbitrary private chart data, including chartData, without possessing a legitimate share link. This issue is fixed in version 5.2.3.9hCVE-2026-584909.8 CRÍ—
——0Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.10hCVE-2026-978486.5 MÉD17.1%
——5A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.12h