Azure Monitor Agent Elevation of Privilege Vulnerability

Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Windows UPnP Device Host Elevation of Privilege Vulnerability

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

Windows UPnP Device Host Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft High Performance Compute Pack HPC allows an authorized attacker to elevate privileges locally...

Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Function Discovery Service fdwsd.dll allows an authorized attacker to elevate privileges locally...

Windows Hello Security Feature Bypass Vulnerability

Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally...

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

MAL-2026-2825 Malicious code in centralogger (npm)

dom-utils-lite and centralogger, with identical payloads. On npm install, a postinstall hook fetches the attacker’s SSH public key from a Supabase storage bucket, appends it to /.ssh/authorizedkeys, harvests the victim’s IP, username, and hostname, then uploads that metadata to the same Supabase...

EUVD-2026-22174

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information...

PT-2026-32776

Name of the Vulnerable Software and Affected Versions Microsoft Management Console affected versions not specified Description Improper access control in the Microsoft Management Console allows an authorized attacker to elevate privileges locally, enabling them to affect the system. Recommendatio...

PT-2026-32820

CVE-2026-32150 Concurrent execution using shared resource with improper synchronization 'race condition' in Function Discovery Service fdwsd.dll allows an authorized attacker to… https://t.co/OE3MjzOxx2...

PT-2026-32881

CVE-2026-33120 | Microsoft SQL Server 2022 GDR | Remote Code Execution Description Untrusted pointer dereference in Microsoft SQL Server 2022 GDR allows an auth'd attacker to achieve RCE over a network by triggering invalid memory access. Severity: High Exploitation: Unknown Public PoC: Unknown...

PT-2026-32836

Name of the Vulnerable Software and Affected Versions Azure Monitor Agent affected versions not specified Description Improper input validation allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2026-32862

Name of the Vulnerable Software and Affected Versions Microsoft Brokering File System affected versions not specified Description A double free issue in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. A double free occurs when a program attempts to fre...

PT-2026-32823

🪟 CVE-2026-32153 is “Speech Runtime” but the real threat is Windows’ EoP roulette. When Microsoft says confidence = high, you patch before your users say “hello” to SYSTEM. https://t.co/uMdtsmG92G SpeechRuntime LocalPrivilegeEscalation SecurityUpdateGuide WindowsCve...

PT-2026-32865

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An untrusted pointer dereference in ICOMP allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that...

PT-2026-32740

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A type confusion issue in Windows OLE allows an authorized attacker to access resources using an incompatible type, which can lead to local privilege escalation. Recommendations At the moment...

PT-2026-32772

🪟 CVE-2026-27910 reminds us: Windows Installer metadata is basically a neon sign for attackers. Great—patch time, again. Enterprise risk never really “goes away,” does it? https://t.co/VVCvsxvJkF ElevationOfPrivilege PrivilegeEscalation WindowsInstaller MsrcSecurityUpdates https://t.co/vnE4IWgHgA...

PT-2026-32786

Name of the Vulnerable Software and Affected Versions Desktop Window Manager affected versions not specified Description A use after free issue allows an authorized attacker to elevate privileges locally. Use after free occurs when an application continues to use a pointer after it has been freed...

PT-2026-32746

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description A buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose sensitive information locally, which may affect the system. A buffer over-read occurs when a progr...