rootpwn

critical · CVSS v3 8.8 · CVSS v4 9.3 · EPSS 0.00124

CVE-2026-94146

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file …

Description

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

Severity
critical
CVSS v2
6.8
CVSS v3
8.8
CVSS v4
9.3
EPSS
0.00124

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-94142

CVE-2026-94142 exposes a write-what-where flaw in the BioStar Temperature Monitor Utility driver (BS_HWMIO64_W10.sys). The vulnerability allows a local attacker to manipulate the PhysicalAddress argument of the IOCTL handler, potentially leading to arbitrary memory writes. It is rated critical and has been publicly disclosed.

View analysis

critical

CVE-2026-94301

CVE-2026-94301 exposes a proxy class resolution bypass in Apache MINA, allowing attackers to evade allow‑list checks and potentially execute arbitrary code. The flaw remains in the 2.0.x and 2.1.x maintenance branches even though it was fixed in 2.2.x. It can compromise confidentiality, integrity, and availability of Java applications that use these libraries.

View analysis

critical

CVE-2026-94379

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47

View analysis