HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66804 — Improper access control in Windows Cross Device Service allows an authorized att...

·Source: NIST NVD

Updated:

Executive Summary

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Analysis

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. CVSS Score: 7.8. Published: 2026-08-11T17:19:01.733.

Indicators of Compromise (1)

CVE (1)
CVE-2026-66804
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-15341 — The User Session Synchronizer plugin for WordPress is vulnerable to Authenticati...

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` param

CVE-2026-15341
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-15303 — The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass...

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user

CVE-2026-15303
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-14484 — The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress ...

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the righ

CVE-2026-14484
NIST NVD