Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

Windows VHD miniport driver Elevation of Privilege Vulnerability

Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

FreeRDP has heap-use-after-free in rail_window_free

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.

Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

OpenVPN: OpenVPN: Denial of service or memory leakage via incomplete TLS guard

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

Windows Server Elevation of Privilege Vulnerability

Use after free in Windows Server allows an authorized attacker to elevate privileges locally.

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

openvpn: OpenVPN: Denial of Service due to memory leak in tls-crypt-v2 client key extraction

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Buffer Over-read in Wireshark

RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows Push Notifications Elevation of Privilege Vulnerability

Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Windows Netlogon Spoofing Vulnerability

Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.

Windows Bind Filter Driver Elevation of Privilege Vulnerability

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Windows GDI+ Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network.

Windows File History Service Elevation of Privilege Vulnerability

Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally.

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

Windows Print Spooler Components Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.

a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.