CVE-2026-45804
📛 CVE Title
(no title)
Description
Diffusers: TOCTOU Trust Remote Code Bypass
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 7.5 / 10
- CVSS vector
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H- Effective score
- 7.5 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-45804
- Linked Threat
- CVE-2026-45804 — CVE-2026-45804
NVD / KEV / EPSS data refreshed 2026-05-25 00:15 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-44711
EUVD enrichment is queued; refresh the page in a few seconds.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-45804 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-45804 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:cyberpress.org
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .
2026-05-26 02:59 UTC -
web:cybersecuritynews.com
No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.
2026-05-26 02:59 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-26 02:59 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-26 02:59 UTC -
web:thehackernews.com
Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...
2026-05-26 02:59 UTC -
web:windowsreport.com
Microsoft patched two actively exploited Defender zero-days affecting Windows systems and security components.
2026-05-26 02:59 UTC -
web:www.resolvedsecurity.com
What is CVE-2026-45804 About? This vulnerability in the HuggingFace `diffusers` package allows for arbitrary code execution during the `DiffusionPipeline.from_pretrained` flow.
2026-05-26 02:59 UTC -
web:www.securityweek.com
Microsoft has announced mitigations for CVE - 2026 -45585, a BitLocker bypass triggered via FsTx in Windows Recovery.
2026-05-26 02:59 UTC -
web:www.techradar.com
Microsoft patches two actively exploited zero‑day flaws in Defender, tracked as CVE‑2026‑41091 (privilege escalation) and CVE‑2026‑45498 (denial of service) Updates were shipped ...
2026-05-26 02:59 UTC -
web:www.windowscentral.com
A faulty BitLocker configuration is forcing some PCs into BitLocker recovery mode after the April 2026 update, but there's a workaround to resolve this issue.
2026-05-26 02:59 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.