55
55
55
30
30
ZDI-26-606: Microsoft Windows Compatibility Appraiser Link Following Local Privilege Escalation Vulnerability
ZDI disclosed a link-following flaw in Windows Compatibility Appraiser (CVSS 7.0) enabling local privilege escalation from the LOCAL SERVICE context.
ZDI-26-606 describes a link-following vulnerability in the Windows Compatibility Appraiser component that permits local privilege escalation. An attacker must already be able to execute low-privileged code in the LOCAL SERVICE context on the target system. ZDI rated the issue 7.0 on the CVSS scale; the advisory lists no CVE identifier. No active exploitation is reported.
18
30
55
35
55
30
30
35
35
30
30
30
30
42
30
30
35
30
30
35
55
30
30
60
30
42
55
30
30
30
Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws
Jellyfin 12.0 fixes unauthorized file access and web client XSS flaws, but requires careful upgrades due to breaking database migrations and plugin changes.
The open-source media server release prevents crafted requests from reading files outside designated directories, blocks unauthorized re-runs of the setup wizard, rejects plugin packages with unsafe names, strengthens parental control enforcement, and fixes cross-site scripting vulnerabilities in browser-based administration and media access workflows. Upgrades require a manual backup because the database schema migration is irreversible; supported paths start from version 10.10.7 or 10.11.x, and duplicate case-insensitive usernames will break migration. The release also retires legacy /emby/ and /mediabrowser/ routes, disables deprecated authentication by default, and targets .NET 10, requiring plugin rebuilds.
45
55
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
30
30