Windows Security App Spoofing Vulnerability

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

Windows Local Security Authority (LSA) Denial of Service Vulnerability

Null pointer dereference in Windows Local Security Authority LSA allows an authorized attacker to deny service over a network...

Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

Cert CC: CVE-2025-3052 InsydeH2O Secure Boot Bypass

Untrusted pointer dereference in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

Windows Installer Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

Windows SDK Elevation of Privilege Vulnerability

Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally...

Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio allows an authorized attacker to execute code over a network...

Windows SMB Client Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...

Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

PT-2025-24846 · Microsoft · Windows Storage Management Provider +1

Name of the Vulnerable Software and Affected Versions: Windows Storage Management Provider affected versions not specified Description: The issue is an out-of-bounds read that allows an authorized attacker to disclose information locally. Recommendations: At the moment, there is no information...

PT-2025-24831 · Microsoft · Windows Smb +1

Name of the Vulnerable Software and Affected Versions: Windows SMB affected versions not specified Description: The issue is related to an integer overflow or wraparound in Windows SMB, which allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no...

PT-2025-24839 · Microsoft · Windows Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library affected versions not specified Description: The issue is related to the use of an uninitialized resource in the Windows DWM Core Library, which allows an authorized attacker to disclose information locally...

CVE-2025-1777 BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save

The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'uxcbpageoptionssave' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2025-36880

Name of the Vulnerable Software and Affected Versions: Windows NTFS affected versions not specified Description: A stack-based buffer overflow exists in Windows NTFS that could allow a local attacker to execute code. The vulnerability may also allow remote attackers to execute arbitrary code and...

Qualcomm Fixes 3 Zero-Days Used in Targeted Android Attacks via Adreno GPU

Qualcomm has shipped security updates to address three zero-day vulnerabilities that it said have been exploited in limited, targeted attacks in the wild. The flaws in question, which were responsibly disclosed to the company by the Google Android Security team, are listed below - CVE-2025-21479...

CVE-2025-48480 FreeScout Has Business Logic Errors

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERMEDITUSERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's...