CVE-2026-85903

A vulnerability exists in the Windows Domain Name Service (DNS Server) caused by an untrusted pointer dereference . This flaw allows an unauthorized attacker to achieve Remote Code Execution (RCE) over a network. The vulnerability is rated as High severity with a CVSS score of 8.8. While exploita...

CVE-2026-85905

A heap-based buffer overflow exists in the Windows UI Immersive Server . This vulnerability allows an authorized attacker to achieve local privilege escalation . The impact includes high levels of risk to confidentiality, integrity, and availability. Remediation is available through an official f...

CVE-2026-83889

The Windows DNS Server is affected by a vulnerability involving the release of an invalid pointer or reference . This flaw allows an authorized attacker to achieve remote code execution over a network. The vulnerability is associated with CWE-763 . No specific exploit information or remediation d...

CVE-2026-83771

A Use after free vulnerability exists in the Windows Camera Frame Server Monitor . This flaw allows an unauthorized attacker to elevate privileges over an adjacent network. The vulnerability is associated with CWE-416 and has a High base severity score of 8.8. No specific exploit details or direc...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-83665

A null pointer dereference vulnerability exists in the Windows DHCP Server , which could allow an unauthorized attacker to cause a denial of service over the network. The vulnerability is associated with CWE-476 . No specific versions, root cause files, or exploit links are provided in the docume...

CVE-2026-70207

A heap-based buffer overflow vulnerability exists in Network Policy Server (NPS) . This flaw allows an authorized attacker to achieve remote code execution over a network. The vulnerability is classified with a CVSS 3.1 base score of 7.5 (High) , indicating significant impact on confidentiality, ...

CVE-2026-70201

An out-of-bounds read vulnerability exists in the Windows DHCP Server . This flaw allows an authorized attacker to perform a local denial of service (DoS). The vulnerability is associated with CWE-125 (Out-of-bounds Read) and CWE-416 (Use After Free). Official remediation is available through a M...

CVE-2026-70071

The DNS Server is affected by a vulnerability involving the improper verification of cryptographic signatures . This flaw allows an authorized attacker to perform tampering locally . The vulnerability is categorized under CWE-347 . While the documents confirm the root cause and impact, specific d...

CVE-2026-70066

A use after free vulnerability exists in the Windows DHCP Server . This flaw allows an authorized attacker to perform a local elevation of privilege . The vulnerability is classified with a CVSS 3.1 score of 7.0, indicating a high impact on confidentiality, integrity, and availability. No specifi...

CVE-2026-70069

A stack-based buffer overflow vulnerability exists in the Windows DHCP Server . This flaw allows an authorized attacker to achieve remote code execution over a network. The vulnerability carries a CVSS 3.1 base score of 8.8 (High) , indicating significant impact on confidentiality, integrity, and...

CVE-2026-96246

An out-of-bounds read vulnerability exists in Network Policy Server (NPS) . This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability is associated with CWE-125 and has a HIGH CVSSv3.1 severity score of 7.5 . No specific root cause, affected versions, or ...

CVE-2026-87710

A vulnerability exists in the Microsoft Local Security Authority Server (lsasrv) due to improper access control . This flaw allows an authorized attacker to achieve local privilege escalation . The vulnerability is associated with CWE-362 (Race Condition). No specific exploit details or mitigatio...

CVE-2026-70167

A type confusion vulnerability (CWE-843, CWE-822) exists in the Windows Domain Name Service (DNS Server) . This flaw allows an authorized attacker to achieve Remote Code Execution (RCE) over a network. The vulnerability is characterized by the access of resources using incompatible types. While t...

CVE-2026-70244

The Windows DNS Server is affected by an out-of-bounds read vulnerability (CWE-125). This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5 (Medium) , which requires user interaction and possesses a network attack vecto...

CVE-2026-88096

A race condition vulnerability exists in the Windows DCOM Server due to concurrent execution using a shared resource with improper synchronization. This flaw allows an authorized attacker to achieve local privilege elevation . No specific details regarding affected versions or exploit availabilit...

CVE-2026-85865

The Windows DHCP Server is susceptible to an improper authentication vulnerability, which allows an authorized attacker to bypass a security feature locally. The vulnerability is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Exploitation details are not provi...

CVE-2026-85811

A Use after free vulnerability exists in Network Policy Server (NPS) , which could allow an unauthorized attacker to execute code over an adjacent network. The vulnerability is classified as having a High severity base score of 7.5. No specific versions, affected components, or remediation steps ...

CVE-2026-85806

A critical integer underflow (wrap or wraparound) vulnerability exists in the Network Policy Server (NPS) . This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.80 . While the documents confirm...

CVE-2026-85810

A Use after free vulnerability in the Windows Telephony Server allows an authorized attacker to achieve local privilege elevation . The vulnerability is categorized under CWE-416 . While the CVSS 3.1 score indicates a High severity (7.0) with local access and low privileges required, specific tec...