CVE-2025-49707

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally...

CVE-2025-48807

Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2025-48807

Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2025-47954

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2025-25005

Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network...

CVE-2025-25005

Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network...

CVE-2025-49712

CVE-2025-49712 covers a remote code execution in Microsoft SharePoint caused by deserialization of untrusted data. Connected sources confirm this affects SharePoint Server (2016/2019 and related Office SharePoint components) and is tractable via network access with low privileges (CVSS v3.1: AV:N...

CVE-2025-48807

CVE-2025-48807 affects Windows Hyper-V: improper restriction of communication to intended endpoints enables an authorized, local attacker to execute code. The CVE is tracked with a 3.1 3.1 CVSSv3.1 vector: Local, High impact on confidentiality, integrity, and availability; exploit requires Low pr...

CVE-2025-53789

CVE-2025-53789 affects Windows StateRepository API where missing authentication enables local privilege escalation. The NCSC advisory references this CVE with CVSS 3.1/7.8 (High) and impact described as escalating privileges. No explicit affected product/version details or fix/remediation are pro...

CVE-2025-53788

CVE-2025-53788 affects Windows Subsystem for Linux (WSL2). A Time-of-check time-of-use (TOCTOU) race condition in the WSL kernel allows a locally authenticated attacker to elevate privileges. The CVE is tied to WSL2 prior to version 2.5.10, with a CVSSv3.1 base score of 7.0 (High) under LOCAL att...

CVE-2025-53779

CVE-2025-53779 is a Windows Kerberos Elevation of Privilege vulnerability. The flaw is described as a relative path traversal in Windows Kerberos that can allow an authorized attacker to elevate privileges over the network, potentially achieving domain administrator rights via the delegated Manag...

CVE-2025-50155

CVE-2025-50155 corresponds to a local privilege-escalation vulnerability in Windows Push Notifications. Affected component: Windows Push Notifications service. Root cause: access of a resource using an incompatible type (type confusion). Impact: authorized attacker on the same device can escalate...

CVE-2025-53778

CVE-2025-53778 is a Windows NTLM elevation-of-privilege flaw caused by improper authentication in NTLM that can enable a network-authenticated attacker with low privileges to elevate to SYSTEM. It is discussed in security reports (e.g., KREBS patch-tuesday coverage) and is addressed by August 202...

CVE-2025-50157

CVE-2025-50157 affects Windows Routing and Remote Access Service (RRAS) with an information disclosure due to use of an uninitialized resource. The base CVSS v3.1 score is 5.7 (Network, Low attack complexity, Privileges Required: Low, User Interaction: Required; Confidentiality Impact: High). Mic...

CVE-2025-53726

CVE-2025-53726 affects Windows Push Notifications and is described as an in-resource access using an incompatible type ('type confusion') that allows an authenticated local attacker to elevate privileges. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL attack vector, LOW attack complexity, and ...

CVE-2025-53725

Technical details about CVE-2025-53725 are not provided in the connected documents. Public exposure, affected components, and fixes are not described here; monitor for updates.

CVE-2025-53724

CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...

CVE-2025-53721

Technical details are not publicly available in the provided connected documents. The CVE is described as a use-after-free in Windows Connected Devices Platform Service enabling local privilege elevation, but specifics (root cause, affected versions, exploit method, and fix) are not disclosed her...

CVE-2025-53720

Technical details about CVE-2025-53720 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories; current entries reference RRAS vulnerability but lack affected versions, exploit information, or mitigations in these sources.

CVE-2025-53719

CVE-2025-53719 affects Windows Routing and Remote Access Service (RRAS); an uninitialized resource in RRAS can allow an authorized network attacker to disclose information. The issue is tied to RRAS in Windows, with CVSS v3.1 base score 5.7 (Network, Low attack complexity, Privileges required: Lo...