CVE-2026-0008
High · 8.4CVSS
8.4
EPSS
0.1%
Published
Mar 2, 2026
CISA due date
—
The record
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118687 Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7… CWE-441
- CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could… CWE-441
- CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. CWE-441
- CVE-2026-114478 Insufficient preservation of the original sender in the forwarding of Progressive Robot… CWE-441
- CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using… CWE-441
- CVE-2026-83837 Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to… CWE-441
- CVE-2026-70148 Improper authorization in Windows Broadcast DVR User Service allows an authorized… CWE-441
- CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes where… CWE-441