CVE-2026-69346

CVE-2026-69346 is a heap-based buffer overflow in Windows Print Spooler Components that allows an authorized attacker to elevate privileges over a network. The flaw carries a CVSS 3.1 score of 8.0 (HIGH) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, meaning exploitation requires low privil...

CVE-2026-69348

CVE-2026-69348 is a heap-based buffer overflow in the Windows Win32K kernel component that allows an authorized, locally-privileged attacker to elevate privileges . The CVSS 3.1 score is 7.8 (HIGH) , with low attack complexity and no user interaction required. CISA's SSVC assessment indicates no ...

CVE-2026-69344

CVE-2026-69344 is an out-of-bounds read vulnerability in Windows Print Spooler Components that allows an authorized local attacker with low privileges to disclose information without user interaction. The CVSS v3.1 base score is 5.5 (MEDIUM) , reflecting the local attack vector, low complexity, a...

CVE-2026-69342

Windows DHCP Server is affected by an out-of-bounds read vulnerability (CVE-2026-69342) that allows an unauthenticated, remote attacker to cause a denial of service . The CVSS v3.1 score is 7.5 (HIGH) with an attack vector of Network, low complexity, no privileges required, and high availability ...

CVE-2026-69343

CVE-2026-69343 is an out-of-bounds read in the Windows Overlay Filter component that allows a low-privilege local attacker to achieve information disclosure without user interaction. The vulnerability is rated CVSS 5.5 (MEDIUM) with a vector of local attack, low complexity, and high confidentiali...

CVE-2026-69340

CVE-2026-69340 is a heap-based buffer overflow in Windows NTFS that allows an authorized, low-privilege attacker to elevate privileges over a network . The vulnerability requires user interaction and carries a high attack complexity, yielding a CVSS 3.1 base score of 7.1 (HIGH) with high impact t...

CVE-2026-69335

CVE-2026-69335 is a use-after-free vulnerability in Windows Win32K that allows an authorized attacker to elevate privileges locally . Microsoft rates it CVSS 3.1: 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires local access, low privileges, and high ...

CVE-2026-69332

CVE-2026-69332 is an out-of-bounds read in Windows NTFS that allows an authorized, low-privilege attacker to escalate privileges over a network with user interaction. The CVSS 3.1 score is 8.0 (HIGH) with impacts of High across Confidentiality, Integrity, and Availability. No specific affected ve...

CVE-2026-69331

CVE-2026-69331 is a use-after-free vulnerability in Windows Remote Access Connection Manager that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 3.1: 7.0) with a local attack vector , high complexity , and low privileges required . No user intera...

CVE-2026-69329

BranchCache in Windows is affected by an out-of-bounds read vulnerability that allows an unauthorized attacker to cause a denial of service over a network. The vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH) (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating remote exploitability without...

CVE-2026-69328

CVE-2026-69328 is an untrusted search path vulnerability in Windows Storage that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity, no user interaction required, and high...

CVE-2026-69351

Windows Universal Plug and Play (UPnP) Device Host contains an information disclosure vulnerability that allows a locally authenticated attacker with low privileges to expose private personal information without user interaction. The CVSS v3.1 score is 5.5 (Medium) with a high confidentiality imp...

CVE-2026-69322

A double free vulnerability in the Microsoft Windows Search Component allows an authorized, network-based attacker to elevate privileges . The CVSS 3.1 score is 8.0 (High) , with a network attack vector, low privileges required, and user interaction required, impacting confidentiality, integrity,...

CVE-2026-69324

CVE-2026-69324 is a local privilege elevation vulnerability in Windows Performance Monitor caused by type confusion (access of resource using incompatible type). An authorized attacker with low privileges can exploit this locally without user interaction to gain high impact on confidentiality, in...

CVE-2026-69319

CVE-2026-69319 is a local privilege elevation vulnerability in the Windows USB Video Driver , caused by a race condition — concurrent execution using a shared resource with improper synchronization. An attacker with low local privileges and no user interaction can exploit this under conditions of...

CVE-2026-69316

CVE-2026-69316 is a buffer over-read vulnerability in the Windows Overlay Filter component. An authorized local attacker with low privileges can exploit it to disclose sensitive information . The attack requires high complexity and no user interaction, with a CVSS v3.1 base score of 4.7 (MEDIUM) ...

CVE-2026-69317

Windows Remote Desktop Client is affected by an out-of-bounds read vulnerability that allows an authorized attacker to disclose information over a network. The flaw is classified as an information disclosure with a CVSS 3.1 score of 5.7 (Medium) , requiring low privileges and user interaction. CI...

CVE-2026-86669

A remote improper authentication vulnerability in aircheng-org iWebShop-5 (versions up to 5.15 ) affects the Login function in controllers/systemseller.php. Manipulating the Name argument allows an unauthenticated remote attacker to bypass authentication. The project scores CVSS 3.1: 7.3 (HIGH) w...

CVE-2026-69318

Windows Imaging Component contains an out-of-bounds read flaw that allows a locally authenticated attacker to disclose information. The vulnerability carries a CVSS 3.1 score of 5.5 (MEDIUM) , with a local attack vector, low complexity, low privileges required, no user interaction, and a High imp...

CVE-2026-69308

Microsoft Standard XPS is affected by an out-of-bounds read that allows an authorized, local attacker to disclose information . The vulnerability requires low privileges and no user interaction, with a CVSS 3.1 score of 5.5 (MEDIUM) (C:H/I:N/A:N). CISA's SSVC assessment rates exploitation as none...

CVE-2026-69312

CVE-2026-69312 is an out-of-bounds read in Windows NTFS that allows an authorized local attacker to elevate privileges . The flaw resides in the NTFS filesystem component of Windows. The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-complexit...

CVE-2026-69315

Windows License Manager is affected by an information disclosure vulnerability (CVE-2026-69315) where sensitive system information is exposed to an unauthorized control sphere, allowing an authorized local attacker to disclose information. The vulnerability requires low privileges and local acces...

CVE-2026-69313

Microsoft Standard XPS is affected by a heap-based buffer overflow that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) , with a network attack vector, high complexity, low privileges required, and user interaction required, leading to high imp...

CVE-2026-69303

CVE-2026-69303 is an out-of-bounds read in the Push Message Routing Service (Microsoft), rated CVSS 5.5 (MEDIUM) . An authorized attacker with low privileges can exploit this locally to disclose information, with no integrity or availability impact. CISA's SSVC assessment indicates no known explo...

CVE-2026-69321

CVE-2026-69321 affects Windows Power Dependency Coordinator , a Windows system component. The root cause is missing authentication for a critical function, which allows a locally authenticated attacker with low privileges to perform tampering (integrity impact). The CVSS 3.1 score is 5.5 (Medium)...

CVE-2026-69301

A stack-based buffer overflow in the Windows Win32K component allows an authorized attacker to achieve privilege elevation over a network. The CVSS 3.1 score is 8.0 (HIGH) , with low attack complexity, low privileges required, and user interaction required. Exploitation details are not yet public...

CVE-2026-69300

CVE-2026-69300 is a use-after-free vulnerability in the Windows Push Notifications component that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a high-impact but locally exploitab...

CVE-2026-69314

CVE-2026-69314 is a use-after-free vulnerability in the Windows Device Association Broker service that allows an authorized attacker to elevate privileges over a network . The vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) , with an attack vector of Network, High complexity, Low privileges ...

CVE-2026-69289

CVE-2026-69289 is an elevation of privilege vulnerability in Windows Setup Files Cleanup , caused by improper link resolution before file access ("link following"). An authorized local attacker with low privileges can exploit it without user interaction to gain high impact across confidentiality,...

CVE-2026-69294

Microsoft COM for Windows is affected by an information disclosure vulnerability caused by the generation of an error message containing sensitive information. An authorized local attacker can exploit this to disclose information, with no user interaction required. The CVSS 3.1 score is 5.5 (Medi...

CVE-2026-69297

CVE-2026-69297 affects Windows DHCP Server , where passwords are stored in a recoverable format, allowing an authorized attacker (with low privileges) to disclose information over a network. The CVSS v3.1 score is 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability impa...

CVE-2026-69295

CVE-2026-69295 is an out-of-bounds read in the Windows USB Driver that allows an authorized local attacker to escalate privileges. The flaw yields high impact across confidentiality, integrity, and availability (CVSS 3.1 score 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a low-...

CVE-2026-69283

CVE-2026-69283 is a heap-based buffer overflow in the Windows CD-ROM Driver that allows an authorized local attacker to elevate privileges . The vulnerability requires low privileges , no user interaction , and has low attack complexity , resulting in a CVSS 3.1 score of 7.8 (HIGH) with High impa...

CVE-2026-69299

Microsoft COM for Windows is affected by a use-after-free vulnerability that allows an authorized local attacker to achieve privilege escalation. The CVSS 3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, and low required privileges. No user interaction is needed, and all thr...

CVE-2026-69275

CVE-2026-69275 is a use-after-free vulnerability in the Kernel Streaming WOW Thunk Service Driver that allows an authorized attacker to escalate privileges locally. The CVSS 3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector , high complexity...

CVE-2026-69286

CVE-2026-69286 is an out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized local attacker to disclose information . The vulnerability is rated CVSS 3.1: 5.5 (MEDIUM) with a local attack vector, low complexity, and high confidentiality impact but no inte...

CVE-2026-69284

CVE-2026-69284 is a heap-based buffer overflow in Windows DCOM Server that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with low complexity and low privileges...

CVE-2026-69277

CVE-2026-69277 is a stack-based buffer overflow in the Microsoft Local Security Authority Server (lsasrv) component that enables a locally authenticated attacker to escalate privileges . The vulnerability is scored CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, and low privilege...

CVE-2026-69305

CVE-2026-69305 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 base score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H , indicating that exploitation requires ...

CVE-2026-69269

CVE-2026-69269 is an integer underflow (wrap or wraparound) vulnerability in Microsoft Standard XPS that allows an authorized attacker with local access and low privileges to achieve local privilege escalation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH )....

CVE-2026-69270

A heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) allows a locally authenticated attacker to escalate privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8 HIGH ). No specific affected Windows version or patc...

CVE-2026-68895

CVE-2026-68895 is a numeric truncation error in Internet Storage Name Service (iSNS) that allows an authorized, local attacker to disclose information. The flaw yields a CVSS 3.1 score of 5.5 (Medium) with high confidentiality impact but no integrity or availability impact, requiring low privileg...

CVE-2026-69280

CVE-2026-69280 is a use-after-free vulnerability in Windows Push Notifications that allows an authorized attacker to achieve local privilege escalation . Microsoft assigned a CVSS 3.1 base score of 7.0 (HIGH) with a vector of local attack, high complexity, low privileges required, and high impact...

CVE-2026-69266

CVE-2026-69266 is an integer overflow or wraparound vulnerability in Windows DHCP Server that allows an unauthorized attacker to achieve remote code execution over the network. The CVSS 3.1 base score is 8.8 (High) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA's SSVC assessment rates...

CVE-2026-68894

CVE-2026-68894 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker to elevate privileges over a network . The vulnerability is rated CVSS 8.0 (High) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , meaning it requires low privileges and user interact...

CVE-2026-69288

CVE-2026-69288 is a use of uninitialized resource vulnerability in Windows GDI+ that allows a locally authenticated attacker with low privileges to disclose information . The attack vector is local , requires no user interaction , and has no impact on integrity or availability , with a high confi...

CVE-2026-69274

CVE-2026-69274 is a Use After Free vulnerability in Windows Win32K that allows an authorized attacker to achieve privilege elevation over a network. The CVSS 3.1 score is 7.1 (HIGH) , with the attack requiring network vector, high complexity , low privileges , and user interaction , impacting con...

CVE-2026-69272

A heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 7.1 (HIGH) , with an attack vector of network, high complexity , low privileges required , and user interaction required , leading to high impact on co...

CVE-2026-68891

CVE-2026-68891 is an out-of-bounds read in Microsoft Standard XPS that allows an authorized attacker to disclose information locally. The CVSS v3.1 score is 4.7 (MEDIUM) , reflecting a local attack vector with high complexity and low privileges required, resulting in high confidentiality impact w...

CVE-2026-68889

A heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. The CNA-assessed CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires low privileges, user interaction, an...