CVE-2026-27925

CVE-2026-27925 concerns a use-after-free in Windows Universal Plug and Play (UPnP) Device Host that allows an adjacent-network attacker to disclose information. Affected component: Windows UPnP Device Host (upnp.dll). Impact as described: information disclosure with high confidentiality impact; n...

CVE-2026-32160

CVE-2026-32160 is a Windows Push Notifications Elevation of Privilege vulnerability. The CVSSv3.1 score is 7.8 (HIGH), with local, high-impact access and no user interaction. Exploit code maturity is UNPROVEN; remediation is an official fix per Microsoft. References point to the Microsoft update ...

CVE-2026-32214

Technical details about CVE-2026-32214 are not provided in the given documents. No explicit affected products, vulnerable components, impact, or remediation details are disclosed here. Monitor for updates from official sources.

CVE-2026-50695

CVE-2026-50695 refers to a stack-based buffer overflow in Microsoft Windows Active Directory Federation Services (AD FS) that enables an unauthenticated, remote attacker to cause a denial of service over the network. The vulnerability is described with a CVSS v3.1 base score of 7.5 (HIGH) with at...

CVE-2026-54132

CVE-2026-54132: Heap-based buffer overflow in the Windows Kernel can enable privilege escalation with physical access. Documents consistently describe an attacker who gains local, physical access to exploit the heap overflow to elevate privileges. The described impact is local elevation of privil...

CVE-2026-58526

Technical details (affected product/component/root cause/versions/exploit info) are not publicly available in the provided documents. Monitor updates from NVD/CVE records and vendor advisories for any forthcoming specifics.

CVE-2026-58610

CVE-2026-58610: A heap-based buffer overflow in Microsoft Windows Media Foundation is described as allowing an unauthorized attacker to execute code locally. The NVD entry confirms the vulnerability and impact (local code execution) with a CVSS 3.1 base score of 7.8 (HIGH) and a local attack vect...

CVE-2025-53722

CVE-2025-53722 affects Windows Remote Desktop Services. Described as Denial-of-Service via uncontrolled resource consumption, exploitable over the network with no user interaction and no privileges required. CVSS v3.1 base score 7.5 (Network, Low attack complexity, No privileges, No user interact...

CVE-2025-54102

CVE-2025-54102 is a use-after-free in the Windows Connected Devices Platform Service that allows an authenticated, local attacker to escalate privileges (obtain increased entitlements). The connected documents corroborate the local-privilege-escalation impact (NCSC advisory lists CVE-2025-54102 w...

CVE-2025-59207

CVE-2025-59207 is an elevation-of-privilege vulnerability in the Windows Kernel caused by an untrusted pointer dereference, enabling a locally authenticated attacker to elevate privileges. The Initial Description confirms the vulnerability type and impact. The Connected Documents provide Windows-...

CVE-2025-60704

Technical details about CVE-2025-60704 are not publicly provided in the supplied Connected Documents. The initial description notes a Kerberos cryptographic step missing that could enable network-based privilege elevation, but no vendor/version/impact specifics are disclosed here. Monitor for upd...

CVE-2025-60705

Technical details about CVE-2025-60705 (affected product, root cause, impact, or Fix) are not provided in the connected documents. Monitor for updates from Microsoft/MSRC for validation, impact, and remediation.

CVE-2026-20843

CVE-2026-20843 describes an Elevation of Privilege in Windows Routing and Remote Access Service (RRAS) due to improper access control. The CVE is confirmed by multiple feeds; affected is RRAS on Windows. The reported impact is local privilege escalation for an authorized attacker with low privile...

CVE-2026-21508

CVE-2026-21508 concerns improper authentication in Windows Storage, enabling a locally authenticated attacker to elevate privileges. The CVSS v3.1 base score is 7.0 (HIGH), with LOCAL attack vector, HIGH impact on confidentiality, integrity, and availability, and a HIGH attack complexity requirin...

CVE-2026-27914

CVE-2026-27914 affects the Microsoft Management Console (MMC). It is an Elevation of Privilege vulnerability where a local attacker with low privileges and no user interaction can potentially gain high impact on confidentiality, integrity, and availability due to the underlying root cause describ...

CVE-2026-32084

CVE-2026-32084 is a Windows vulnerability labeled as a Windows Print Spooler information-disclosure issue with local access and potential exposure of sensitive data via Windows File Explorer. The CVE entry notes local attack vector, low attack complexity, and low privileges required, with a high ...

CVE-2026-32089

Summary: CVE-2026-32089 is a local elevation-of-privilege vulnerability in Windows Speech Brokered API (Speech Brokered Api) described as a use-after-free issue. The vulnerability can be exploited by an authorized attacker to gain higher privileges on a vulnerable Windows host. Connected advisori...

CVE-2026-32212

CVE-2026-32212 refers to a Universal Plug and Play information disclosure in upnp.dll. The CVSSv3.1 base score is 5.5 (Medium) with LOCAL attack vector, LOW attack complexity, LOW privileges required, and no user interaction. Impact is confined to confidentiality (HIGH) with no integrity/availabi...

CVE-2026-45606

CVE-2026-45606 concerns an out-of-bounds read in the Microsoft UxTheme Library (uxtheme.dll) that allows an authorized, low-privilege user to cause a local denial of service. The NVD/NIST and CVE records concur on the impact as a local DoS; attack vector is LOCAL, with LOW prerequisites and NONE ...

CVE-2026-50311

CVE-2026-50311 concerns Windows Server where improper access control allows an authorized user to locally elevate privileges. Root cause: insufficient authorization checks in the affected Windows Server components, enabling privilege escalation with local access and no user interaction required. ...

CVE-2026-50337

CVE-2026-50337 is a Windows Notification vulnerability described as an issue with an incorrect type conversion or cast that allows an authorized attacker to achieve local privilege escalation. The CVE is listed with a CVSS v3.1 base score of 7.8 (HIGH), indicating a local attack vector with low c...

CVE-2026-50358

CVE-2026-50358 is a Windows Media use-after-free vulnerability that enables a locally authenticated attacker to elevate privileges. Affected component: Windows Media. Root cause: use-after-free in Windows Media code path. Impact: local privilege escalation with high severity as per Microsoft guid...

CVE-2026-50460

CVE-2026-50460 describes a race-condition in Windows Runtime due to concurrent execution using a shared resource, enabling elevation of privileges over a network. The affected software is Windows Runtime; the root cause is improper synchronization during concurrent access. Reported impact indicat...

CVE-2026-55004

CVE-2026-55004 corresponds to a local privilege-elevation flaw described as a double-free in Microsoft Printer Drivers. The CVSSv3.1 score is 7.8 (High) with local attack vector, low attack complexity, and privileges required, no user interaction, impacting confidentiality, integrity, and availab...

CVE-2026-57084

CVE-2026-57084 affects Windows File Explorer. Description: a use of an uninitialized resource leads to local information disclosure. CVSSv3.1 base score 5.5 (Medium); attack vector LOCAL, required user interaction, no confidentiality integrity or availability impact beyond disclosure per provided...

CVE-2026-58541

CVE-2026-58541 — Windows DWM Core Library Elevation of Privilege due to a type confusion in DWM. Affected component: Windows DWM Core Library/DWM (Windows OS). Description from sources: Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to e...

CVE-2026-62701

CVE-2026-62701 affects the Windows Telephony Service and is caused by a use-after-free in that component. The vulnerability enables a local, authenticated attacker with LOW privileges and NO user interaction to achieve privilege escalation with HIGH impact on confidentiality, integrity, and avail...

CVE-2025-53143

CVE-2025-53143 is listed for Windows Message Queuing with high impact (CVSS 3.1: 8.8, Network, Privileges Low, User Interaction None). The entry indicates a remote code execution potential via resource type confusion. Connected sources confirm the vulnerability exists in MSMQ and note a network-e...

CVE-2025-53724

CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...

CVE-2025-53807

CVE-2025-53807 describes a race condition in the Microsoft Graphics Component that allows local privilege escalation. The NCSC document confirms CVE-2025-53807 under Windows-related vulnerabilities. The CVSS3.1 vector from the initial document indicates a Local attack vector, High impact on confi...

CVE-2025-58732

CVE-2025-58732 is described as a use-after-free in Inbox COM Objects that enables local code execution. The Connected Documents provide broader Windows security updates (KBs and advisories) but do not specify a vendor/product remediation or a patch explicit to this CVE in the provided materials. ...

CVE-2025-58735

CVE-2025-58735 is a Use-after-free vulnerability in Inbox COM Objects leading to local code execution. The base CVSS v3.1 score is 7.0 (HIGH) with LOCAL attackVector, HIGH impact on confidentiality/integrity/availability, and user interaction required. Connected MSKB/NCSC entries confirm a Window...

CVE-2026-20829

CVE-2026-20829 is a TPM Trustlet Information Disclosure vulnerability in Windows TPM: an out-of-bounds read can allow an authorized, local attacker to disclose information. The linked Nessus/NVD/CIRCL entries confirm Windows TPM involvement and a local attack vector with low privileges. Microsoft...

CVE-2026-20836

CVE-2026-20836 is a Windows graphics kernel vulnerability where a race condition in a shared resource allows local privilege elevation. The issue stems from concurrent execution with improper synchronization in the Graphics Kernel. The impact is local privilege escalation (C:H/I:H/A:H per CVSS 3....

CVE-2026-21234

CVE-2026-21234 concerns Windows Connected Devices Platform Service where a race condition due to improper synchronization enables local privilege escalation for an authorized attacker. The vulnerability affects the platform service's concurrent execution via a shared resource; impact includes con...

CVE-2026-25166

CVE-2026-25166 /Windows System Image Manager ADK: A.local, low-privilege, no-user-interaction remote code execution vulnerability with high impact (C/H/I/A) per CVSS 3.1; fix is an official update. Exploitation details are not provided in the document.

CVE-2026-26161

Technical details such as affected product/component, root cause, impact specifics, or available remediation are not provided in the supplied documents. Monitor official CVE and vendor advisories for updates.

CVE-2026-49171

The CVE-2026-49171 entry describes a Use-After-Free vulnerability in Windows Speech Runtime that enables a locally authenticated attacker to elevate privileges. Affected: Microsoft Windows Speech Runtime components; root cause: use-after-free leading to arbitrary code or privilege escalation (det...

CVE-2026-50347

CVE-2026-50347 is a Windows Data.dll vulnerability characterized by a heap-based buffer overflow that allows an unauthorized, local attacker to execute code. The affected component is Windows Data.dll; the underlying issue is a heap overflow leading to remote-code-execution-style impact via local...

CVE-2026-50475

CVE-2026-50475 is a Windows Kernel information‑disclosure vulnerability caused by a buffer over‑read in the kernel. An authorized local attacker can disclose information from memory. Documented impact is local information disclosure; no remote code execution is indicated in the provided sources. ...

CVE-2026-50476

Microsoft Windows CVE-2026-50476 is a local privilege-escalation vulnerability in the Windows Network Connections Service caused by a use-after-free. Affected component is the Windows Network Connections Service; root cause is a use-after-free condition that enables an authorized attacker to elev...

CVE-2026-50478

CVE-2026-50478 is a Windows Kernel use-after-free vulnerability that enables local privilege escalation by an authorized attacker. The entry cites a Windows Kernel UAF issue with a high overall impact (CVSS v3.1: 7.8, Local, Privilege Escalation, Integrity/Confidentiality/Availability: High). Con...

CVE-2026-54986

NVD reports CVE-2026-54986 as a heap-based buffer overflow in Windows Win32K that enables a locally authenticated attacker to perform privilege escalation. Affected component is Windows Win32K; root cause described as heap overflow within that subsystem. The available sources do not specify vulne...

CVE-2026-57093

CVE-2026-57093 – Windows Ancillary Function Driver for WinSock is a reported use-after-free vulnerability in the WinSock ancillary function driver that can be exploited locally to achieve privilege escalation. The issue affects the specific Windows driver handling WinSock operations; successful e...

CVE-2026-57095

CVE-2026-57095 affects Windows Win32K (Win32k.sys) and is described as an elevation-of-privileges vulnerability due to exposure of sensitive information to an unauthorized actor, enabling local privilege escalation. Public details confirm impact as privilege escalation with local access and a hig...

CVE-2026-58536

CVE-2026-58536 : A use-after-free in Windows Cloud Files Mini Filter Driver allows an authorized local attacker to achieve elevation of privileges. Affected component: Windows Cloud Files Mini Filter Driver. Impact: local privilege escalation with high impact; exploit details are not provided in ...

CVE-2026-69845

Windows DHCP Server is affected by a heap-based buffer overflow that allows an unauthorized, remote attacker to achieve code execution over a network without any user interaction or prior privileges. The vulnerability is rated CRITICAL (CVSS 9.8) with high impact to confidentiality, integrity, an...

CVE-2025-55338

CVE-2025-55338 is associated with Windows BitLocker and is described as a ROM-patching deficiency that could allow circumvention of a security feature via a physical attack. Connected documents reference Windows BitLocker entries including CVE-2025-55338 in MSKB/brief vulnerability lists, noting ...

CVE-2025-55699

CVE-2025-55699 is listed in the connected NCSC MS security advisories as a Windows Kernel vulnerability with impact described as “Access to sensitive data.” The initial description also notes local disclosure exposure in Windows Kernel. The connected documents do not provide a root-cause detail, ...

CVE-2025-59198

CVE-2025-59198 is a Microsoft Windows vulnerability in the Windows Search Component caused by improper input validation that can allow an authorized, local attacker to cause a denial of service. The CVE is shown in the Windows Search Component entries with a base CVSS v3.1 score of 5.0 (MEDIUM), ...