CVE-2025-5463

Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information...

CVE-2025-6995 Improper Encryption in Ivanti Endpoint Manager

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords...

Microsoft Teams Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Teams allows an authorized attacker to elevate privileges locally...

Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability

Time-of-check time-of-use toctou race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally...

Windows Notification Elevation of Privilege Vulnerability

Use after free in Windows Notification allows an authorized attacker to elevate privileges locally...

Windows Media Elevation of Privilege Vulnerability

Use after free in Windows Media allows an authorized attacker to elevate privileges locally...

Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally...

Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

Out-of-bounds read in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

Windows TCP/IP Driver Elevation of Privilege Vulnerability

Null pointer dereference in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

Windows Secure Kernel Mode Information Disclosure Vulnerability

Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally...

Windows Graphics Component Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

Microsoft Brokering File System Elevation of Privilege Vulnerability

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally...

Windows Search Service Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

Universal Print Management Service Elevation of Privilege Vulnerability

Use after free in Universal Print Management Service allows an authorized attacker to elevate privileges locally...

Microsoft Brokering File System Elevation of Privilege Vulnerability

Null pointer dereference in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...

CVE-2025-21004

Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the device...

CVE-2025-21006

Out-of-bounds write in handling of macro blocks for MPEG4 codec in libsavsvc.so prior to Android 15 allows local attackers to write out-of-bounds memory...

CVE-2025-24006

A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root...

CVE-2025-24005

CVE-2025-24005 is a local privilege escalation affecting the PHOENIX CONTACT CHARX SEC series, caused by an input validation error in a vulnerable script accessible via SSH. An attacker with a local account can escalate to root. The public documents describe the vulnerability and impact but do no...