2998 matches found
CVE-2026-49183
CVE-2026-49183 describes a race condition in Windows Clipboard Server due to improper synchronization, enabling a local attacker with low privileges to elevate to higher rights. The affected component is the Windows Clipboard Server (shared resource handling) and the root cause is concurrent exec...
CVE-2026-49178
CVE-2026-49178 is a heap-based buffer overflow in Windows Active Directory Domain Services that enables a network-based remote code execution by an authenticated, low-privilege attacker. The affected component is AD DS; the vulnerability enables code execution with high impact on confidentiality,...
CVE-2026-48564
CVE-2026-48564 refers to a heap-based buffer overflow in Windows DHCP Server that enables a network-based remote code execution by an authorized attacker. According to the available records, the vulnerability is high severity (CVSS v3.1: 8.8), with network as the attack vector, low attack complex...
CVE-2026-48581
CVE-2026-48581 affects Microsoft Surface. It describes insufficient granularity of access control enabling a locally authenticated attacker to escalate privileges (Impact: high; CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Connected records show the vulnerability in Surface Broker SDM...
CVE-2026-44800
CVE-2026-44800 concerns a race condition in Windows Push Notifications caused by improper synchronization of a shared resource. This vulnerability enables an authorized, local attacker to achieve privilege elevation. Documented impact is Local, with Confidentiality, Integrity, and Availability al...
CVE-2026-34348
CVE-2026-34348 affects the Windows Event Logging Service. The issue is a protection mechanism failure that can allow an authorized attacker to disclose information over a network. According to the available records, the exploit surface is network-based with low privileges required and no user int...
CVE-2026-40400
CVE-2026-40400 is a Windows PowerShell relative path traversal vulnerability that could enable an authorized attacker to execute code over a network. The CVE entry identifies a remote code execution risk with NETWORK attack vector, LOW attack complexity, and LOW privileges required, but with UI i...
CVE-2026-58647
CVE-2026-58647 affects Microsoft Power BI Power BI Report Server. The issue is an improper neutralization of input during web page generation, enabling cross-site scripting. Attackers must be authorized, require user interaction, and can exploit over the network to perform spoofing with high impa...
CVE-2026-58631
CVE-2026-58631 involves Windows Admin Center where improper authorization allows an authorized attacker to execute code locally. The available sources describe a local attack vector with high impact (C:H/I:H/A:H) and a CVSS v3.1 base score of 7.8, indicating remote code execution risk within the ...
CVE-2026-58602
CVE-2026-58602 is a Windows kernel-mode-driver vulnerability described as a use-after-free that enables an authorized, local attacker to achieve elevation of privilege. The public documents do not provide product/vendor specifics beyond “Windows kernel” and “kernel-mode driver,” nor details on af...
CVE-2026-58601
CVE-2026-58601 describes a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized, local attacker to elevate privileges. The available description specifies a local-privelege-escalation impact, but does not provide product/version specifics, exploitati...
CVE-2026-58526
Technical details (affected product/component/root cause/versions/exploit info) are not publicly available in the provided documents. Monitor updates from NVD/CVE records and vendor advisories for any forthcoming specifics.
CVE-2026-57107
Summary: CVE-2026-57107 is an elevation-of-privilege flaw due to improper authentication in Windows Admin Center. An authorized local attacker can escalate privileges. The CVSS v3.1 base score is 7.8 (HIGH), with local attack vector, low complexity, and high impacts on confidentiality, integrity,...
CVE-2026-56169
CVE-2026-56169 concerns improper authentication in Windows Admin Center that can allow an attacker authenticated on the network to elevate privileges. The CVSS 3.1 base score is 8.1 (High), with network as the attack vector, low attack complexity, and low privileges required; confidentiality and ...
CVE-2026-56155
CVE-2026-56155 affects Active Directory Federation Services (AD FS) with insufficient granularity in access control, enabling an authorized local attacker to escalate privileges. Documents indicate a Privilege Escalation impact and note updates have been released by Microsoft to address the vulne...
CVE-2026-56155
Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...
CVE-2026-55144
The CVE-2026-55144 vulnerability concerns Windows Cryptography API: Next Generation (CNG). The issue is a missing cryptographic step in the Windows CryptoAPI that could allow an authorized, local attacker to tamper data, with impact to confidentiality and integrity (CVSSv3.1: Local attack, Low sk...
CVE-2026-54118
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...
CVE-2026-54117
Microsoft SQL Server is vulnerable to a deserialization-of-untrusted-data flaw (CWE-502) allowing an unauthorized network attacker to execute arbitrary code with no authentication required (CVSS 9.8 critical). Affected products include SQL Server 2016 through 2025, Fabric Data Warehouse, and Powe...