Windows Update Service Elevation of Privilege Vulnerability

Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally...

Microsoft Graphics Component Elevation of Privilege Vulnerability

Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

Windows Audio Service Elevation of Privilege Vulnerability

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally...

Windows Audio Service Elevation of Privilege Vulnerability

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally...

Windows Win32k Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

Windows Rich Text Edit Control Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

Windows Win32k Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

Windows Overlay Filter Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

Windows AppX Deployment Extensions Elevation of Privilege Vulnerability

Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally...

Windows Certificates Elevation of Privilege Vulnerability

Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally...

Windows Error Reporting Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network...

Windows DWM Core Library Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...

Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally...

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Time-of-check time-of-use toctou race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally...

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

Configuration Manager Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2025-33073

CVE-2025-33073 — Windows SMB Client NTLM Reflection EoP Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. An improper access control flaw in the Windows SMB Client that revives NTLM reflection techniques thought to be mitigated — letti...

CVE-2021-3493-Exploit

CVE-2021-3493-Exploit A proof-of-concept local privilege escalation exploit for CVE-2021-3493, written in C. 📌 Description This repository contains a C implementation of the exploit for CVE-2021-3493. This is a Local Privilege Escalation LPE vulnerability in the OverlayFS implementation in the...

CVE-2026-74032 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions

Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC...