Security Vulnerabilities
Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to version 11.3.1 or later.
CVSS Score
8.3
EPSS Score
0.001
Published
2026-08-21
Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.
CVSS Score
8.3
EPSS Score
0.001
Published
2026-08-21
Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later.
CVSS Score
8.2
EPSS Score
0.001
Published
2026-08-21
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.
CVSS Score
2.4
EPSS Score
0.001
Published
2026-08-21
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-08-21
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
CVSS Score
10.0
EPSS Score
0.005
Published
2026-08-20
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
CVSS Score
8.6
EPSS Score
0.006
Published
2026-08-20
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
CVSS Score
10.0
EPSS Score
0.016
Published
2026-08-20
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
CVSS Score
9.9
EPSS Score
0.004
Published
2026-08-20
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
CVSS Score
9.6
EPSS Score
0.006
Published
2026-08-20
Page 1