CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure

The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.

CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission

A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

Windows Graphics Kernel Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.

Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates.

- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files. This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.

Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.

Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Author+ Stored XSS via savePost

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure via select2Ajax

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.

Microsoft Brokering File System Elevation of Privilege Vulnerability

Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

HID Parser Library Elevation of Privilege Vulnerability

Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

HID Parser Library Elevation of Privilege Vulnerability

Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Windows USM Communication Manager Elevation of Privilege Vulnerability

Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally.

HID Parser Library Elevation of Privilege Vulnerability

Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Windows NetBIOS Elevation of Privilege Vulnerability

Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.

Windows DNS Denial of Service Vulnerability

Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network.

Role: DNS Server Denial of Service Vulnerability

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

Windows DNS Information Disclosure Vulnerability

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.