CVE-2025-54103

Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally...

CVE-2025-53810

Access of resource using incompatible type 'type confusion' in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...

CVE-2025-53800

No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

Microsoft Brokering File System Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally...

Windows TCP/IP Driver Elevation of Privilege Vulnerability

Time-of-check time-of-use toctou race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

Xbox Gaming Services Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Xbox allows an authorized attacker to elevate privileges locally...

ZhenShi Mibro Fit App 安全漏洞

ZhenShi Mibro Fit App is a smartwatch companion app from China-based ZhenShi. A security vulnerability exists in ZhenShi Mibro Fit App version 1.6.3.17499, which originates from an improperly exported AndroidManifest.xml component and could lead to a local attack...

PT-2025-36877

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: A use-after-free issue in Windows BitLocker can allow a local attacker to elevate privileges. This elevation-of-privilege allows attackers to affect the system. Recommendations: At the...

PT-2025-36850

Name of the Vulnerable Software and Affected Versions: Capability Access Management Service camsvc affected versions not specified Description: A race condition exists within the Capability Access Management Service camsvc due to improper synchronization during concurrent execution using a shared...

Medium: libtiff

Issue Overview: A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function gethistogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been...

CVE-2025-48550

In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48559

In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48542

In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26439

In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system component due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-48559

In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48554

In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2025-26449

In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26432

In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-9815

A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the loca...