CVE-2026-69337

A double free vulnerability in the Windows Registry allows an authorized attacker to elevate privileges over a network . The flaw requires low privileges and user interaction , with high attack complexity , but results in high impact to confidentiality, integrity, and availability (CVSS 3.1 score...

CVE-2026-69366

CVE-2026-69366 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges over a network, with user interaction required. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. No specific af...

CVE-2026-69310

CVE-2026-69310 is a use-after-free vulnerability in Windows DNS that allows an authorized attacker to elevate privileges locally. The flaw resides in the DNS component and requires local access with low privileges and no user interaction, though the attack complexity is rated as high. The CVSS 3....

CVE-2026-69325

CVE-2026-69325 is a heap-based buffer overflow in Microsoft JScript that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.1 (High) , with a network attack vector, high complexity, no required privileges or user interaction, and high impact o...

CVE-2026-69336

CVE-2026-69336 is a heap-based buffer overflow in Microsoft Standard XPS that allows an authorized attacker to achieve privilege elevation over a network. The vulnerability is rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires us...

CVE-2026-69296

A use-after-free vulnerability in Windows Device Association Service allows an authorized attacker to escalate privileges over a network. The flaw requires low privileges, user interaction, and high attack complexity, yielding a CVSS 3.1 score of 7.1 (HIGH) with full impact on confidentiality, in...

CVE-2026-69279

CVE-2026-69279 is a use after free vulnerability in the Windows Cloud Files Mini Filter Driver that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity but...

CVE-2026-69292

A double free vulnerability in the Remote Desktop Gateway Service (Microsoft) allows an authorized local attacker to elevate privileges . The flaw requires local access with low privileges and high attack complexity , but grants full compromise of confidentiality, integrity, and availability upon...

CVE-2026-69307

CVE-2026-69307 is a heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized local attacker to escalate privileges . The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning low-privilege local ac...

CVE-2026-69267

CVE-2026-69267 is an information disclosure vulnerability in Windows Connected User Experiences and Telemetry , caused by insufficient granularity of access control . An authorized local attacker can leverage this flaw to disclose information, with a CVSS 3.1 score of 6.5 (MEDIUM) and a scope cha...

CVE-2026-69276

CVE-2026-69276 is an integer underflow (wrap or wraparound) in the Microsoft UxTheme Library (uxtheme.dll) that allows an unauthorized attacker to achieve remote code execution over the network. The CVSS 3.1 score is 9.8 (Critical) , reflecting network-based attack vector with no privileges or us...

CVE-2026-69281

CVE-2026-69281 is a use-after-free vulnerability in the Windows License Manager component that allows an authorized local attacker to elevate privileges. The vulnerability is rated CVSS 7.0 (High) with a vector of local attack, high complexity, low privileges required, no user interaction, unchan...

CVE-2026-68893

CVE-2026-68893 is a use-after-free vulnerability in the Windows Remote Desktop Licensing Service that allows an authorized attacker to elevate privileges over a network . The flaw is rated CVSS 3.1: 7.1 (High) with a vector requiring network access, high complexity, low privileges, and user inter...

CVE-2026-68892

CVE-2026-68892 is a heap-based buffer overflow in Microsoft Standard XPS that allows an authorized local attacker to escalate privileges . The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low complexity, low privi...

CVE-2026-68890

CVE-2026-68890 is a heap-based buffer overflow in Microsoft Standard XPS that allows an authorized local attacker to escalate privileges . The vulnerability is scored CVSS 3.1: 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting low attack complexity, low privileges requir...

CVE-2026-69271

A heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network with user interaction required . The vulnerability is scored CVSS 3.1: 8.0 (HIGH) with high impact to confidentiality, integrity, and availability. CISA's SSVC assessment indi...

CVE-2026-68884

A heap-based buffer overflow in the Windows Kernel allows an authorized (low-privilege) local attacker to elevate privileges , per Microsoft's advisory (CVE-2026-68884). The vulnerability carries a CVSS v3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploit...

CVE-2026-68881

CVE-2026-68881 is an out-of-bounds read in Microsoft Standard XPS that allows an authorized local attacker to disclose information . The flaw carries a CVSS v3.1 score of 5.5 (Medium) — local attack vector, low complexity, low privileges required, no user interaction, with high confidentiality im...

CVE-2026-68897

A heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to escalate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity, low required privileg...

CVE-2026-68878

CVE-2026-68878 is a stack-based buffer overflow in the Windows Fast FAT Driver that allows an authorized attacker to elevate privileges over a network . The CNA (Microsoft) assigned a CVSS 3.1 score of 8.0 (HIGH) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , indicating network-reachable e...

CVE-2026-68875

CVE-2026-68875 is a buffer over-read in Windows NTFS that allows an authorized local attacker to achieve code execution . The vulnerability is rated CVSS 3.1 7.8 (High) with a local attack vector, low complexity, low privileges required, and no user interaction needed. No exploitation details or ...

CVE-2026-68851

CVE-2026-68851 is a buffer over-read vulnerability in Windows NTFS that allows an authorized local attacker to disclose information . The CVSS 3.1 score is 5.5 (Medium) with a local attack vector, low complexity, low privileges required, and no user interaction; impact is limited to high confiden...

CVE-2026-68846

CVE-2026-68846 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R, indicating a network-based attack requiring high complexity , low privileges , and...

CVE-2026-68845

CVE-2026-68845 is a heap-based buffer overflow in the Windows Program Compatibility Assistant Service that allows an authorized attacker to perform local privilege escalation . Microsoft rates it HIGH severity (CVSS 3.1: 7.8) with a local attack vector, low complexity, low privileges required, an...

CVE-2026-68849

CVE-2026-68849 is an out-of-bounds read vulnerability in the Windows Bluetooth Port Driver that allows an authorized local attacker to disclose information . The attack requires low privileges and high complexity , with no user interaction needed. The impact is limited to confidentiality (high), ...

CVE-2026-68847

A use-after-free vulnerability in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally . The weakness is scored CVSS 3.1 7.0 (HIGH) with a local attack vector, high complexity, and low privileges required. CISA's SSVC assessment indicates no...

CVE-2026-68841

Windows NTFS is affected by a heap-based buffer overflow that allows an authorized, local attacker with low privileges to elevate privileges without user interaction. The vulnerability is classified with a CVSS 3.1 score of 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — indicating high impact...

CVE-2026-68835

CVE-2026-68835 is a use-after-free vulnerability in Windows Print Spooler Components that allows an authorized attacker to elevate privileges over a network . The Microsoft-assigned CVSS 3.1 score is 7.1 (HIGH) , with an attack vector of network, high complexity, low privileges required, and user...

CVE-2026-68833

CVE-2026-68833 is a heap-based buffer overflow in Windows NTFS (New Technology File System) that allows an unauthorized attacker to achieve code execution . The attack requires physical access to the system (CVSS:3.1 AV:P), with no privileges or user interaction needed, and results in high impact...

CVE-2026-68832

CVE-2026-68832 is a local privilege escalation vulnerability in Windows NTFS caused by an integer overflow or wraparound . An authorized attacker with low privileges can exploit this with low complexity and no user interaction to achieve high impact on confidentiality, integrity, and availability...

CVE-2026-68830

CVE-2026-68830 is an information disclosure vulnerability in Windows Universal Plug and Play (UPnP) Device Host , caused by improper link resolution before file access ('link following'). An authorized local attacker (low privileges, no user interaction) can exploit this to disclose information, ...

CVE-2026-68824

A race condition (concurrent execution using a shared resource with improper synchronization) in Windows Connected User Experiences and Telemetry allows an authorized local attacker to escalate privileges. The vulnerability is rated CVSS 7.0 (High) with local attack vector, high complexity, and f...

CVE-2026-68787

A heap-based buffer overflow in Microsoft SQL Server allows an authorized attacker with low privileges to execute code locally. The flaw requires no user interaction and results in high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8 – HIGH , vector AV:L/AC:L/PR:L/...

CVE-2026-68785

Microsoft SQL Server is affected by a heap-based buffer overflow that allows an authorized attacker (high privileges required) to execute code over a network. The CVSS v3.1 score is 4.9 (Medium) , reflecting a network attack vector with low complexity, high privileges required, and no user intera...

CVE-2026-68784

CVE-2026-68784 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network . The CVSS v3.1 score is 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a high confidentiality impact with low priv...

CVE-2026-68781

CVE-2026-68781 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The flaw requires low privileges and no user interaction , with low attack complexity . The CVSS 3.1 base score is 6.5 (MEDIUM) , reflecting a h...

CVE-2026-67633

Microsoft SQL Server is affected by an out-of-bounds read vulnerability that allows an authorized attacker (low privileges) to trigger a denial of service over the network. The CNA-assigned CVSS 3.1 score is 6.5 (MEDIUM) , reflecting network attack vector, low complexity, and high availability im...

CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized (low-privilege) attacker to achieve remote code execution over the network. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating hi...

CVE-2026-67630

CVE-2026-67630 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network . The CVSS 3.1 score is 6.5 (MEDIUM) , with low attack complexity, low privileges required, no user interaction, and high impact on confidentiali...

CVE-2026-67629

CVE-2026-67629 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impac...

CVE-2026-67370

CVE-2026-67370 is an SQL injection vulnerability in Microsoft SQL Server where improper neutralization of special elements used in a SQL command allows an authorized attacker to elevate privileges over a network. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L...

CVE-2026-67373

This CVE describes a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 8.8 (HIGH) (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating low attack complexity and low privilege requirem...

CVE-2026-50349

A race condition (concurrent execution using a shared resource with improper synchronization) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker with low privileges to escalate privileges locally. The vulnerability is rated CVSS 3.1 7.0 (HIGH) with high impact on c...

CVE-2026-67368

Microsoft SQL Server is affected by an improper link resolution before file access ('link following') flaw that allows an authorized attacker to elevate privileges over a network. The root cause is a link following issue in how SQL Server resolves file links prior to access. Per the assigned CVSS...

CVE-2026-62801

CVE-2026-62801 is a path traversal vulnerability in Windows PowerShell that allows an unauthorized, remote attacker to bypass a security feature. The improper limitation of a pathname to a restricted directory means an attacker can reference files or resources outside the intended directory. The ...

CVE-2026-55007

CVE-2026-55007 is a double free vulnerability in Microsoft Exchange Server that allows an unauthorized, unauthenticated attacker to achieve remote code execution over the network. The vulnerability is rated CVSS 8.1 (HIGH) with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation...

CVE-2026-57098

CVE-2026-57098 is an improper verification of cryptographic signature vulnerability in Windows RDP Client (Microsoft Remote Desktop App for Windows). An unauthorized network attacker can disclose information with no user interaction and no prior privileges required. The CVSS 3.1 score is 7.5 (HIG...

CVE-2026-77482

CVE-2026-77482 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity but required user interac...

CVE-2026-85360

A use after free flaw in the Windows Kernel allows a local, authenticated attacker to elevate privileges . The vulnerability is scored CVSS 3.1 7.0 (HIGH) with a local attack vector , high attack complexity , low privileges required , and no user interaction , resulting in high impact to confiden...

CVE-2026-83941

CVE-2026-83941 is a missing authorization vulnerability in Entra ID (Microsoft's identity and access management service) that allows an attacker with low privileges to elevate privileges over a network. The assigned CVSS 3.1 score is 9.9 (CRITICAL) with a scope change, indicating high impact on b...