312860 matches found
CVE-2026-102220
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally...
CVE-2026-102207
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-102204
Improper link resolution before file access 'link following' in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...
CVE-2026-102206
Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack...
CVE-2026-102202
Improper access control in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to elevate privileges locally...
CVE-2026-102187
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally...
CVE-2026-102192
Integer underflow wrap or wraparound in Windows Failover Cluster allows an unauthorized attacker to deny service over a network...
CVE-2026-102188
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack...
CVE-2026-100215
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally...
CVE-2026-100217
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally...
EUVD-2026-100465
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...
CVE-2026-110130
Dockhand versions prior to 1.0.45 are vulnerable to an authentication bypass due to a flaw in the global auth hook. The system incorrectly skips authentication for paths ending in static-asset extensions like .js , even when those paths include /api/ routes . Because user-mutation handlers fail o...
CVE-2026-110130
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...
CVE-2026-108135
A vulnerability exists in the Windows Backup Engine due to improper link resolution before file access (link following). This flaw allows an authorized attacker to perform a local privilege escalation . The CVSS 3.1 score is 7.0 (High) , with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:...
EUVD-2026-100453
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally...
CVE-2026-105016
A heap-based buffer overflow exists in Microsoft QUIC , which could allow an unauthorized attacker to execute arbitrary code over a network. This vulnerability is classified as CRITICAL with a CVSS score of 9.80 . Affected systems connected to public networks are at a higher risk, as actual abuse...
CVE-2026-108131
A vulnerability in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. The issue has a base severity of High (CVSS 3.1 score of 7.5), with an attack vector of Network and Low attack complexity. While the severity is high, it primarily i...
CVE-2026-108132
A Double free vulnerability exists in Windows Kerberos that allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-415 . While no specific exploit links or internal component paths are provided in the documents, the vulnerability has a High b...