Security Vulnerabilities
Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs.
During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-07-24
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-07-24
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-07-24
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.
CVSS Score
5.1
EPSS Score
0.002
Published
2026-07-24
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
CVSS Score
8.4
EPSS Score
0.003
Published
2026-07-24
Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
CVSS Score
7.4
EPSS Score
0.001
Published
2026-07-24
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
CVSS Score
10.0
EPSS Score
0.007
Published
2026-07-24
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
CVSS Score
10.0
EPSS Score
0.007
Published
2026-07-24
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
CVSS Score
10.0
EPSS Score
0.007
Published
2026-07-24
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
CVSS Score
9.1
EPSS Score
0.006
Published
2026-07-24