| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Null pointer dereference in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
| Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. |
| Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network. |
| Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network. |
| Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. |
| Use after free in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows exFAT File System allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which spawns the attacker-supplied command with attacker-supplied args and an environment merged over os.environ. The process executes on the shared backend host before MCP protocol validation fails — so side effects fire regardless of whether the command speaks MCP. This is a distinct weakness class and exploit primitive from the SSRF (Advisory 2) on the same endpoint, and needs a different fix (role gating / opt-in trust boundary rather than egress controls). This issue has been patched in version 0.0.75. |
| Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address. If a workflow author has already configured an HTTP node that targets internal addresses such as cloud metadata endpoints or private network hosts, and exposed the workflow with anonymous execution, an unauthenticated attacker can trigger the preconfigured SSRF sink. The same project has comprehensive SSRF protection in its MCP integration, which is absent from the HTTP node. This issue has been patched in version 0.0.73. |
