CVE-2026-59004
High · 8.4CVSS
8.4
EPSS
0.1%
Published
Nov 2, 2026
CISA due date
—
The record
In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121443 svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that… CWE-248
- CVE-2026-121414 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a… CWE-248
- CVE-2026-121386 FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's… CWE-248
- CVE-2026-55288 In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service… CWE-248
- CVE-2026-120215 @fastify/cors is the CORS plugin for the Fastify web framework. CWE-248
- CVE-2026-120216 fastify is a web framework for Node.js. CWE-248
- CVE-2026-101175 Null pointer dereference vulnerability in the ArkWeb module. CWE-248
- CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. CWE-248