CVE-2026-7169
HighCVSS 7.5Summary
A vulnerability in Evope Collector prior to version 1.1.7.13 allows a local attacker without privileges to load a malicious DLL by placing a 'wtsapi32.dll' file in the 'C:\ProgramData\Evope\' directory. The 'Evope.Service.exe' component, running with SYSTEM privileges, loads this DLL without verifying its integrity or origin, potentially leading to code execution with SYSTEM privileges and local privilege escalation.
Risk Assessment
An attacker can gain full control over the system, leading to data compromise, malware installation, or permanent integrity violation.
Recommendation
Update Evope Collector to version 1.1.7.13 or later. Additionally, restrict permissions on the 'C:\ProgramData\Evope\' directory and monitor for unusual DLL files in that directory.
Related vulnerabilities
- CVE-2026-116207Critical
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string, allowing subquery injection.
- CVE-2026-115995Critical
A vulnerability was detected in Unitree Robotics Unitree Go2 up to version 1.1.11.4. The set_volume function in gpt_thread.py of the chat_go component mishandles the Value argument, leading to OS command injection. The attack can be launched remotely, and upgrading to version 1.1.11.5 resolves the issue.
- CVE-2026-114820Critical
Vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is easily exploitable by an unauthenticated attacker with network access, leading to unauthorized creation, deletion, or modification of critical data as well as unauthorized access to critical data. The vulnerability also applies to Java deployments that load and run untrusted code in a sandbox (e.g., Java Web Start applications or applets).
- CVE-2026-115933Critical
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back, allowing a user to obtain a validly signed token containing any claims they choose, accepted as a session, an organization invitation with a chosen role, a password reset or an enterprise provisioning token.
- CVE-2026-115557Critical
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- CVE-2026-115932Critical
In Postiz, a media path that is not a web address is treated as a file on the server's disk without verifying it lies inside the upload directory. A registered user can store a crafted media path with a post and cause the publishing worker to read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads are reachable through two further routes, including file existence checks and backend memory exhaustion; self-registration is open by default.
- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-114196Critical
The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.
- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-111402Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This could allow an attacker to execute arbitrary SQL queries.
Original NVD description (English source)
a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS