WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product studio✕
Overview 845 matches · 0 in Waratek scope · 0 protected · 17 exploited · 6 CISA KEV · 68 public PoC · 16 EPSS ≥ 0.5
845matches 0in Waratek scope0.0% 0protected0.0% 17exploited2.0% 6CISA KEV0.7% 68public PoC8.0% 16EPSS ≥ 0.51.9%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 845 100.0% Withdrawn CVE 0 0.0%
Critical 65 7.7% High 547 64.7% Medium 218 25.8% Low 15 1.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 845 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 17 2.0% Working exploit published 55 6.5% Proof of concept only 51 6.0% Forecast only 3 0.4% No public exploit 719 85.1%
split by peak 131 / year
Not applicable: 845 Low: 15Medium: 218High: 547Critical: 65 not blocked: 845 No public exploit: 719Forecast only: 3Proof of concept only: 51Working exploit published: 55Exploited: 17
20004 Not applicable4 High2 Medium2 not blocked4 Working exploit published3 No public exploit1 20011 Not applicable1 High1 not blocked1 No public exploit1 20022 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20030 20042 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 20057 Not applicable7 High4 Medium3 not blocked7 Exploited1 No public exploit6 20069 Not applicable9 High5 Medium3 Low1 not blocked9 Exploited1 Working exploit published4 No public exploit4 200716 Not applicable16 High8 Medium8 not blocked16 Exploited1 Working exploit published8 No public exploit7 200817 Not applicable17 High14 Medium3 not blocked17 Exploited1 Working exploit published7 No public exploit9 200921 Not applicable21 High17 Medium4 not blocked21 Exploited3 Working exploit published8 No public exploit10 20106 Not applicable6 High3 Medium2 Low1 not blocked6 Working exploit published1 No public exploit5 201120 Not applicable20 High13 Medium7 not blocked20 Working exploit published3 No public exploit17 20129 Not applicable9 High3 Medium6 not blocked9 Working exploit published1 No public exploit8 201320 Not applicable20 High7 Medium11 Low2 not blocked20 Working exploit published2 No public exploit18 201415 Not applicable15 Critical3 High4 Medium8 not blocked15 Exploited3 Working exploit published1 No public exploit11 20156 Not applicable6 High2 Medium3 Low1 not blocked6 No public exploit6 20166 Not applicable6 Critical2 High3 Medium1 not blocked6 No public exploit6 201716 Not applicable16 Critical5 High4 Medium7 not blocked16 No public exploit16 201834 Not applicable34 Critical5 High21 Medium8 not blocked34 Working exploit published4 No public exploit30 201939 Not applicable39 Critical2 High22 Medium15 not blocked39 Exploited2 Working exploit published2 No public exploit35 202074 Not applicable74 Critical3 High53 Medium16 Low2 not blocked74 Exploited1 No public exploit73 202183 Not applicable83 Critical3 High63 Medium14 Low3 not blocked83 Exploited2 Working exploit published1 Proof of concept only1 Forecast only2 No public exploit77 202262 Not applicable62 Critical5 High46 Medium10 Low1 not blocked62 Exploited1 Working exploit published2 Proof of concept only2 No public exploit57 2023109 Not applicable109 Critical14 High72 Medium22 Low1 not blocked109 Exploited1 Working exploit published2 Proof of concept only12 Forecast only1 No public exploit93 202486 Not applicable86 Critical7 High60 Medium18 Low1 not blocked86 Working exploit published1 Proof of concept only8 No public exploit77 202550 Not applicable50 Critical7 High32 Medium11 not blocked50 Working exploit published3 Proof of concept only6 No public exploit41 2026131 Not applicable131 Critical9 High86 Medium34 Low2 not blocked131 Proof of concept only22 No public exploit109
200220052008201120142017202020232026
845 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 9 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-96957 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96222 High 2026-10-13 Not applicable No public exploit Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-88092 Critical 2026-10-13 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-85790 Medium 2026-10-13 Not applicable No public exploit Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-70098 High 2026-10-13 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102238 Critical 2026-10-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102235 High 2026-10-13 Not applicable No public exploit Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102234 High 2026-10-13 Not applicable No public exploit Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-102231 High 2026-10-13 Not applicable No public exploit Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-81383 High 2026-09-08 Not applicable No public exploit Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81381 High 2026-09-08 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81380 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81379 High 2026-09-08 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81378 High 2026-09-08 Not applicable No public exploit Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81377 Medium 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-81376 Critical 2026-09-08 Not applicable No public exploit Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81357 High 2026-09-08 Not applicable No public exploit Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81356 High 2026-09-08 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78462 High 2026-09-08 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78461 High 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-77907 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-77906 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-71328 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-70334 High 2026-09-08 Not applicable No public exploit Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-69806 High 2026-09-08 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69805 High 2026-09-08 Not applicable No public exploit External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69439 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69304 Medium 2026-09-08 Not applicable No public exploit Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-65669 Critical 2026-09-08 Not applicable No public exploit Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58649 Medium 2026-09-08 Not applicable No public exploit Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-80098 Critical 2026-09-03 Not applicable No public exploit Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62906 High 2026-09-03 Not applicable No public exploit Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.
CVE-2026-70354 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-70336 High 2026-08-11 Not applicable No public exploit Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-70335 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-69320 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-69306 High 2026-08-11 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69278 High 2026-08-11 Not applicable No public exploit Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-62909 High 2026-08-11 Not applicable No public exploit Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-62902 Medium 2026-08-11 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62901 High 2026-08-11 Not applicable No public exploit Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-62900 Medium 2026-08-11 Not applicable No public exploit Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62899 Medium 2026-08-11 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-62898 High 2026-08-11 Not applicable No public exploit Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-62897 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-62886 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62871 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-59113 High 2026-08-11 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-58650 High 2026-08-11 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47285 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-17583 High 2026-08-05 Not applicable No public exploit The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.
CVE-2026-9128 High 2026-07-14 Not applicable No public exploit A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.
CVE-2026-9127 High 2026-07-14 Not applicable No public exploit A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
CVE-2026-9108 Medium 2026-07-14 Not applicable No public exploit A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
CVE-2026-57102 High 2026-07-14 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-57101 High 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-50659 Medium 2026-07-14 Not applicable No public exploit Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50651 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50649 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-50648 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50646 High 2026-07-14 Not applicable No public exploit Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50528 High 2026-07-14 Not applicable No public exploit Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-50527 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50526 High 2026-07-14 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
CVE-2026-50525 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50524 High 2026-07-14 Not applicable No public exploit Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50520 High 2026-07-14 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-47305 High 2026-07-14 Not applicable No public exploit Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2026-47304 Critical 2026-07-14 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47303 High 2026-07-14 Not applicable No public exploit Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47302 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-47300 High 2026-07-14 Not applicable No public exploit Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47282 Medium 2026-07-14 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-45496 Medium 2026-07-14 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-9143 Medium 2026-06-19 Not applicable No public exploit There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen.  This may silently discard high bits if a size value exceeded the target type's range. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-9142 Critical 2026-06-19 Not applicable No public exploit There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48141 Medium 2026-06-19 Not applicable No public exploit There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhaustion.  This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48140 High 2026-06-19 Not applicable No public exploit There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service. Successful exploitation requires an attacker to supply a specially crafted message containing an out-of-range value. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48139 High 2026-06-19 Not applicable No public exploit There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by triggering a crash.  Successful exploitation requires an attacker to provide an unknown value to the data moniker service. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48138 High 2026-06-19 Not applicable No public exploit There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48137 Critical 2026-06-19 Not applicable No public exploit There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution.  Successful exploitation requires an attacker  to supply a specially crafted Moniker protobuf message.  This affects NI grpc-device 2.17.0 and prior versions.
CVE-2026-48569 High 2026-06-09 Not applicable No public exploit Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47292 High 2026-06-09 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-47287 Medium 2026-06-09 Not applicable No public exploit Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-47284 Medium 2026-06-09 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-47281 Critical 2026-06-09 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-45591 High 2026-06-09 Not applicable No public exploit Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45482 High 2026-06-09 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-40376 High 2026-06-09 Not applicable No public exploit Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41613 High 2026-05-12 Not applicable No public exploit Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41611 High 2026-05-12 Not applicable No public exploit Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-41610 Medium 2026-05-12 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-41109 High 2026-05-12 Not applicable No public exploit Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-32177 High 2026-05-12 Not applicable No public exploit Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32175 Medium 2026-05-12 Not applicable No public exploit A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
CVE-2026-7023 Low 2026-04-26 Not applicable Proof of concept only A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-32203 High 2026-04-14 Not applicable No public exploit Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32178 High 2026-04-14 Not applicable No public exploit Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-5709 High 2026-04-06 Not applicable No public exploit Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
CVE-2026-5708 High 2026-04-06 Not applicable No public exploit Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
‹ prev page 1 of 9 next ›