PowerShell Command Injection in Podman HyperV Machine

Summary A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $ subexpression injection. Affected Code File: pkg/machine/hyperv/stubber.go:647 go resize :=...

EUVD-2026-22463

Untrusted pointer dereference in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

CVE-2026-32156

Use after free in Windows Universal Plug and Play UPnP Device Host allows an unauthorized attacker to execute code locally...

CVE-2026-27929

Time-of-check time-of-use toctou race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally...

CVE-2026-33824

CVE-2026-33824 is a Windows IKE Extension double-free remote code execution affecting IKEV2; described as wormable by ZDI with exploitation possible over UDP/500-4500 and no user interaction. Affected: Windows IKE Service Extensions; impact is remote code execution with SYSTEM-level access on unp...

CVE-2026-33827 Windows TCP/IP Remote Code Execution Vulnerability

...

CVE-2026-32225

CVE-2026-32225 pertains to a Windows Shell security feature bypass. The entry indicates a remote-accessible vulnerability with NETWORK attack vector, requiring user interaction, and impacts confidentiality, integrity, and availability (all HIGH). The CVSSv3.1 base score is 8.8 (HIGH) with an Offi...

CVE-2026-32164 Windows User Interface Core Elevation of Privilege Vulnerability

...

CVE-2026-27912 Windows Kerberos Elevation of Privilege Vulnerability

...

CVE-2026-26152

CVE-2026-26152 pertains to Microsoft Cryptographic Services with a local elevation-of-privilege vulnerability. The CVSS 3.1 vector indicates local access, high impact on confidentiality, integrity, and availability, with user interaction not required. PrivilegesRequired is LOW, AttackComplexity i...

CVE-2026-32216 Windows Redirected Drive Buffering System Denial of Service Vulnerability

...

CVE-2026-32216

Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally...

CVE-2026-32183 Windows Snipping Tool Remote Code Execution Vulnerability

...

CVE-2026-32089 Windows Speech Brokered Api Elevation of Privilege Vulnerability

...

CVE-2026-32087 Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability

...

CVE-2026-32082 Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

...

CVE-2026-27929

CVE-2026-27929 is a Time-of-check Time-of-use (toctou) race condition in Windows LUAFV (LUA File Virtualization Filter Driver) that enables a locally authenticated attacker to elevate privileges. Red Hat and NCSC advisories confirm the Windows LUAFV vulnerability and its local privilege-escalatio...

CVE-2026-27924 Desktop Window Manager Elevation of Privilege Vulnerability

...

CVE-2026-27917 Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability

...

CVE-2026-27908

CVE-2026-27908 is a Windows Elevation of Privilege vulnerability in the TDI Translation Driver (tdx.sys). The CVSS 3.1 base score is 7.0 (HIGH) with LOCAL attack vector, HIGH impact to confidentiality, integrity, and availability. Exploitation is deemed UNPROVEN and requires LOW privileges with N...