CVE-2026-70148Medium· 6.5▾ SunlitImproper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-83837High· 7.8Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-93294Medium· 6.3A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy)
CVE-2025-68944Medium· 5.0Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
CVE-2026-109373High· 8.1ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies
CVE-2026-108261Critical· 9.3Tina is a headless content management system
CVE-2026-107336Medium· 6.5Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite