CVE-2026-26168

CVE-2026-26168 describes a race condition in the Windows Ancillary Function Driver for WinSock that allows an authorized local attacker to elevate privileges. Publicly referenced Red Hat and Dutch/NCSC/CIRCL sources confirm the Windows driver component and local privilege impact; exploitation sta...

CVE-2026-42971

CVE-2026-42971 involves a use of an uninitialized resource in Windows Push Notifications, enabling a locally authenticated attacker to disclose information. Affected component: Windows Push Notifications. Root cause: use of an uninitialized resource. Impact: local information disclosure with Conf...

CVE-2026-56648

CVE-2026-56648 is a Windows Network File System (NFS) server vulnerability described as a time-of-check time-of-use (TOCTOU) race condition that could allow an authorized attacker to elevate privileges over the network. Public sources identify the root cause as a TOCTOU race in NFS and classify t...

CVE-2026-61920

CVE-2026-61920 – Windows DNS Server : A race condition caused by improper synchronization on a shared resource enables an authorized attacker to execute code over a network. Affected product: Windows DNS Server. Root cause: concurrent execution due to lack of proper synchronization in the shared ...

CVE-2026-62885

CVE-2026-62885 describes a heap-based buffer overflow in Windows Win32K that allows an authorized attacker to perform a local privilege escalation . The vulnerability is tied to the Win32K subsystem; the specific code path and vulnerable component are not further detailed in the provided document...

CVE-2026-65774

CVE-2026-65774 : Heap-based buffer overflow in the Windows Installer component allows an authorized, local attacker to elevate privileges. The issue is described as a local, low-attack-complexity vulnerability with high impact on confidentiality, integrity, and availability. No exploitation detai...

CVE-2026-69518

CVE-2026-69518 is a heap-based buffer overflow in Windows Remote Desktop that allows an unauthorized attacker to execute code over a network. The vulnerability is classified with CVSS 3.1 score 8.8 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , indicating network-reachable attack...

CVE-2025-29961

Technical details for CVE-2025-29961 are not provided in the connected documents. The RRAS out-of-bounds read description exists in the Initial Document, but no vendor/affected versions, root cause, or fixes are confirmed here. Monitor for updates.

CVE-2025-49659

Technical details for CVE-2025-49659 are not present in the provided connected documents. Public information about affected products, root cause, exploit status, and fixes is not available here; monitor for updates from official advisories.

CVE-2026-40410

Technical details (affected component, root cause, affected versions, exploit vectors or fixes) are not publicly provided in the supplied documents; monitor for updates from official advisories.

CVE-2026-47648

CVE-2026-47648 — Windows Storage contains an untrusted search path vulnerability that enables a locally authenticated attacker to perform privilege escalation. The issue arises from a trusted component loading an untrusted search path, potentially elevating privileges with high impact (C/H/I/H/A/...

CVE-2026-50349

A race condition (concurrent execution using a shared resource with improper synchronization) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker with low privileges to escalate privileges locally. The vulnerability is rated CVSS 3.1 7.0 (HIGH) with high impact on c...

CVE-2026-24296

CVE-2026-24296 affects Windows Device Association Service, where concurrent execution on a shared resource with improper synchronization (race condition) enables a local, authorized attacker to elevate privileges. The issue is documented across multiple sources (NVD/NCSC/ENISA/CVEs listing) with ...

CVE-2026-27920

CVE-2026-27920 is a Windows vulnerability in the UPnP Device Host that enables a local privilege escalation . The entry indicates a local attack vector with low required privileges and no user interaction, leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 base s...

CVE-2026-35422

Technical details for CVE-2026-35422 (affected components, root cause, impact, or patch) are not provided in the connected documents. Monitor for authoritative updates from official sources.

CVE-2026-45639

The CVE-2026-45639 entry relates to an out-of-bounds read in Windows Remote Desktop Protocol (RDP). The underlying issue enables an unauthenticated, network-based attacker to disclose information over the network without user interaction. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:...

CVE-2026-47289

CVE-2026-47289 is a heap-based buffer overflow in the Remote Desktop Client that enables remote code execution over a network. The vulnerability is exploitable remotely (attack vector: NETWORK) with low complexity and requires user interaction, yielding a high impact on confidentiality, integrity...

CVE-2026-50441

An active CVE: CVE-2026-50441 affects Windows Resilient File System (ReFS). Description confirms an Untrusted pointer dereference leading to local Privilege Escalation by an authorized attacker. Impact per CVSS: Local, Privilege Elevation, with High confidentiality/integrity/availability impact. ...

CVE-2026-56186

CVE-2026-56186 is a Windows Schannel vulnerability described as an out-of-bounds read that enables an authorized attacker to disclose information over a network. The CVE affects the Windows Schannel security component and is rated with CVSS v3.1 base score 8.1 (High) and NETWORK attack vector wit...

CVE-2026-69449

CVE-2026-69449 is a heap-based buffer overflow in Windows BitLocker that allows an authorized attacker to execute code locally. The CVSS 3.1 score is 6.7 (Medium) , reflecting a local attack vector with high privileges required and no user interaction , resulting in high impact on confidentiality...

CVE-2025-47980

Technical details about CVE-2025-47980 (affected product/components, root cause, impact, fixes) are not provided in the connected documents. Monitor for updates as more information becomes public.

CVE-2025-48818

CVE-2025-48818 is a TOCTOU race condition in Windows BitLocker that enables bypass of a security feature via physical access. The CVE is listed in NCSC/NCSC-2025-0213 with impact described as bypassing security measures under Windows BitLocker and a CVSS v3.1 base score of 6.8 (PHYSICAL vector, L...

CVE-2025-48819

Technical details about CVE-2025-48819 are not publicly provided in the supplied documents; no product/version/root-cause/impact information is included beyond the basic description. Monitor for official updates.

CVE-2025-59190

CVE-2025-59190 affects the Microsoft Windows Search Component. It is due to improper input validation and allows a local attacker to cause a Denial of Service. The CVE is rated with CVSS 3.1 (base 5.5, MEDIUM); attack vector LOCAL, privileges REQUIRED NONE, user interaction REQUIRED, and impact l...

CVE-2025-60703

Technical details about CVE-2025-60703 are not provided in the initial or connected documents. Monitor for updates as more specifics (affected product/version, root cause, mitigations) may be published.

CVE-2026-50352

CVE-2026-50352 affects Windows Cryptographic Services. Description: Exposure of sensitive information to an unauthorized actor allows a locally authenticated attacker to disclose information. Impact: information disclosure (CONFIDENTIALITY) with LOCAL attack vector; CVSS 3.1 base 5.5 (AV:L/AC:L/P...

CVE-2026-50372

CVE-2026-50372 — Windows Redirected Drive Buffering : A buffer over-read vulnerability in Windows Redirected Drive Buffering could allow an authorized, local attacker to elevate privileges. The CVE is corroborated by multiple sources (NVD, MSRC, EUVD/ENISA, CIRCL sighting) with an incident descri...

CVE-2026-50388

CVE-2026-50388 is an Windows NTFS local vulnerability described as an out-of-bounds read that allows an unauthenticated/unauthorized attacker to execute code locally. The CVE is tracked across multiple sources (NVD, MSRC, CIRCL) with a base CVSS v3.1 score of 7.8 (High) and LOCAL attack vector, r...

CVE-2026-58530

CVE-2026-58530 affects Windows Resilient File System (ReFS). The issue is a heap-based buffer overflow in ReFS that allows an unauthorized attacker to execute code locally. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH), with LOCAL attack vector, no privileges required, and user inter...

CVE-2026-59135

The CVE-2026-59135 entry describes a weakness in the Microsoft Windows Search Component where weak authentication could allow an authorized local attacker to disclose information. Affected software is Windows with the Windows Search Component implicated as the vulnerable element; root cause is we...

CVE-2026-62716

CVE-2026-62716 involves an integer underflow in Windows DHCP Server that permits information disclosure to an adjacent network. The affected component is Windows DHCP Server; the root cause is a wrap/wraparound error enabling data disclosure, with attack vector described as adjacent network acces...

CVE-2026-62761

CVE-2026-62761 affects Windows DHCP Server. The issue is improper link resolution before file access ("link following"), allowing an authorized attacker to locally elevate privileges. Root cause is in the DHCP Server component; impact is local privilege escalation with high confidentiality/integr...

CVE-2025-29957

Technical details about CVE-2025-29957 (Windows Deployment Services) are not provided in the supplied documents. Please monitor for updated advisories from Microsoft or NVD for affected product/version, root cause, impact, and remediation.

CVE-2025-47982

CVE-2025-47982 affects Windows Storage VSP Driver. The root cause is improper input validation, enabling a locally authenticated attacker to elevate privileges. CVSS v3.1 base score 7.8 (HIGH) with local, low-complexity, no user interaction required; impact includes high confidentiality, integrit...

CVE-2025-53137

CVE-2025-53137 affects Windows' Ancillary Function Driver for WinSock. It is a use-after-free vulnerability that can lead to local privilege escalation when exploited by an authenticated attacker. The connected documents confirm the affected component and the high-severity impact (local, with ele...

CVE-2025-58733

CVE-2025-58733 corresponds to a use-after-free in Inbox COM Objects on Windows that enables local code execution. Connected sources confirm Inbox COM Objects as the vulnerable component and describe the impact as arbitrary code execution by a local attacker. Public advisories from Microsoft and C...

CVE-2026-21247

CVE-2026-21247 is an input-validation flaw in Windows Hyper-V that can allow a locally authenticated attacker to execute arbitrary code. The vulnerability arises from improper handling of input, with a CVSSv3.1 base score of 7.3 (HIGH), indicating local attack vector, low attack complexity, and r...

CVE-2026-40409

Technical details for CVE-2026-40409 are not publicly available in the provided documents. Monitor for updates from Microsoft/NVD for affected products, root cause, impact, and remediation.

CVE-2026-48568

CVE-2026-48568 concerns a protection mechanism failure in Windows Secure Boot that allows a local attacker to bypass a security feature. The connected sources indicate an in-scope vulnerability where an attacker with HIGH privileges and local access can bypass integrity and confidentiality protec...

CVE-2026-50355

CVE-2026-50355 is a vulnerability in Active Directory Federation Services (AD FS) described as a stack-based buffer overflow that enables a remote, unauthenticated attacker to cause a denial of service over the network. The CVSS v3.1 base score is 7.5 (Network, Low attack complexity, No privilege...

CVE-2026-50421

CVE-2026-50421 is a Windows vulnerability in Windows Connected User Experiences and Telemetry described as a local privilege escalation via a resource access type confusion. The CVE entry is supported by multiple records: NVD/NCSC/CIRCL indicate the issue and Microsoft has released updates to add...

CVE-2026-50666

CVE-2026-50666 is a Windows Privilege Escalation vulnerability described as a use-after-free in the Windows Remote Access Connection Manager. The issue allows an authorized attacker to elevate privileges over a network. Public sources (NVD/NCSC/NVD-related) corroborate the impact and indicate Mic...

CVE-2026-50681

CVE-2026-50681 is a Windows Secure Channel information disclosure vulnerability in Windows Cryptographic Services. The available documents describe exposure of sensitive information to an unauthorized actor, allowing a locally authenticated attacker to disclose data. Connected sources confirm the...

CVE-2026-54983

The CVE-2026-54983 entry concerns a stack-based buffer overflow in Active Directory Federation Services (AD FS) that allows an unauthenticated, network-based attacker to trigger a denial of service. The authoritative sources describe the vulnerability as enabling network-ported DoS without requir...

CVE-2026-56175

CVE-2026-56175 describes a heap-based buffer overflow in Windows NTFS that allows an authorized, local attacker to elevate privileges. Connected sources (Microsoft MSRC update, NVD, NTFS/CIRCL sightings) confirm the vulnerability is in Windows NTFS, with local-privilege-escalation potential and a...

CVE-2026-58619

CVE-2026-58619 is a Windows Sensor Data Service vulnerability described as a use-after-free that enables an authorized attacker to locally elevate privileges. The vulnerability is reported with CVSS 3.1: LOCAL attack vector, HIGH impact (C, I, A), and low privileges required with no user interact...

CVE-2026-62711

The CVE-2026-62711 issue is a local privilege escalation caused by a use-after-free in Windows Win32K. Affected component: Win32K memory management; root cause: use-after-free vulnerability. Impact, if exploited: an authorized local attacker can elevate privileges. CVSS v3.1 score is 7.8 ( HIGH )...

CVE-2026-62769

CVE-2026-62769 describes a numeric truncation error in Windows DNS that allows an authorized attacker to elevate privileges locally. The vulnerability arises from a faulty numeric handling (truncation) within the Windows DNS component, enabling local privilege escalation with high impact on confi...

CVE-2026-62887

CVE-2026-62887 is a local information-disclosure flaw in Windows NTFS due to an out-of-bounds read. The vulnerability allows an authenticated attacker with LOW privileges and LOCAL access to read sensitive data without user interaction. The CVSS v3.1 metrics indicate a MEDIUM base score (5.5), wi...

CVE-2026-73025

CVE-2026-73025 is a Security Feature Bypass vulnerability in Windows iSCSI , rooted in weak authentication that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector, low complexity, n...