55
60
55
30
55
55
60
55
55
30
42
60
47
42
55
55
30
55
55
30
ZDI-26-647: VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation Vulnerability
ZDI disclosed an integer overflow in VMware Workstation's VMXNET3 TSO code (CVE-2026-59346) enabling local privilege escalation.
Zero Day Initiative published ZDI-26-647, a CVSS 7.5 integer overflow in the VMXNET3 TSO segmentation code of VMware Workstation. A local attacker who has already obtained the ability to execute high-privileged code on the guest system can exploit the flaw to escalate privileges on affected installations. The issue is tracked as CVE-2026-59346. No exploitation is reported in the advisory.
30
55
42
55
30
60
30
55
55
55
55
35
30
ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access
ASUS patched CVE-2026-19397 (CVSS 7.7) in Control Center Express Agent, letting unauthenticated nearby attackers with an active session take over the host.
ASUS released version 1.7.24 of Control Center Express Agent to fix CVE-2026-19397, a CWE-306 missing-authentication flaw scored 7.7 on CVSS v4. Exploitation requires an active login session on the target and nearby network access, and agent compromise could lead to complete device takeover where the agent runs with elevated privileges. ASUS also issued a same-day advisory for Armory Crate covering ten additional CVEs.
62
30
60
55
55
55
42