CVE-2026-45635

CVE-2026-45635 affects Windows UPnP Device Host through a use-after-free in upnp.dll, enabling remote code execution over the network. The issue is tied to the Universal Plug and Play component, with impact described as remote, unauthenticated code execution; CVSSv3.1 base score 8.1 (HIGH). Affec...

CVE-2026-48564

CVE-2026-48564 refers to a heap-based buffer overflow in Windows DHCP Server that enables a network-based remote code execution by an authorized attacker. According to the available records, the vulnerability is high severity (CVSS v3.1: 8.8), with network as the attack vector, low attack complex...

CVE-2026-50348

CVE-2026-50348 describes a race condition in Windows Runtime where concurrent execution using a shared resource with improper synchronization can allow an unauthenticated attacker to elevate privileges over a network. The description and publicly visible details indicate the vulnerability affects...

CVE-2026-50389

CVE-2026-50389 affects Windows File Explorer and is a local information-disclosure vulnerability where an authorized attacker can disclose sensitive information. The issue is confirmed in Windows File Explorer (Explorer.exe) and is addressed by Microsoft security updates; multiple MSRC/MSKB entri...

CVE-2026-50426

CVE-2026-50426 : Windows DNS Server contains a relative path traversal vulnerability that could allow an authorized attacker on an adjacent network to execute code. Root cause is traversal of relative paths in DNS Server handling, enabling remote code execution. Reported impact is arbitrary code ...

CVE-2026-50461

CVE-2026-50461 is a Windows NTFS heap-based buffer overflow vulnerability that allows a local attacker to execute code. The issue is linked to the NTFS subsystem, enabling arbitrary code execution with high impact (Local, Requires User Interaction, Privilege: None). Public records in NVD/EUVD/NCS...

CVE-2026-50471

CVE-2026-50471 is a heap-based buffer overflow in Windows NTFS that could allow a local attacker to execute arbitrary code. The vulnerability affects Windows NTFS components as described in multiple sources (NVD/NCSC/CIRCL) and is being addressed by Microsoft with published updates (e.g., KB arti...

CVE-2026-50690

CVE-2026-50690 is a Windows SMB information-disclosure vulnerability described as caused by the use of an uninitialized resource within Windows SMB that can allow an authorized local attacker to disclose information. The CVE is linked to Microsoft advisories and MSRC updates addressing the issue,...

CVE-2026-62717

Summary: CVE-2026-62717 is a heap-based buffer overflow in Windows Message Queuing that could allow an authorized local attacker to elevate privileges. This is supported by multiple sources (NVD entry and CVE records). Affected component: Windows Message Queuing. Vulnerability type & root cause: ...

CVE-2026-62745

Summary: CVE-2026-62745 is an information-disclosure vulnerability in Windows DHCP Server caused by an integer underflow (wrap/wraparound). The issue enables an unauthenticated attacker on an adjacent network to potentially disclose information. CVSS 3.1 base score is 6.5 (Medium) with attack vec...

CVE-2025-29839

Technical details about CVE-2025-29839 (affected product/version/root cause/impact/fix) are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2025-33060

CVE-2025-33060 affects the Windows Storage Management Provider and is described as an out-of-bounds read that can allow an authorized, locally authenticated attacker to disclose information. The NCSC advisory confirms it under Windows Storage Management Provider with CVSS 5.5 (LOCAL, Privileges L...

CVE-2025-48000

CVE-2025-48000 is described as a use-after-free vulnerability in the Windows Connected Devices Platform Service that allows an authorized local attacker to achieve privilege escalation. The provided documents specify the vulnerable component and the impact (local privilege escalation) but do not ...

CVE-2025-49708

CVE-2025-49708: A use-after-free vulnerability in the Microsoft Graphics Component can allow an authorized attacker to elevate privileges over the network. Connected Microsoft security updates and advisories indicate this issue is addressed in October 2025 Windows updates (KBs referenced in KB506...

CVE-2026-40407

CVE-2026-40407 describes a heap-based buffer overflow in the Windows Common Log File System (CLFS) Driver that permits an authorized, local attacker to elevate privileges. The vulnerability impact is local privilege escalation with a CVSS v3.1 base score of 7.8 (HIGH) and impact to confidentialit...

CVE-2026-48574

CVE-2026-48574 is a Windows Media vulnerability described as a heap-based buffer overflow that allows an unauthorized attacker to execute code locally. The cited CVSS 3.1 vector (LOCAL, HIGH impact on confidentiality, integrity, and availability; user interaction required; no privileges required)...

CVE-2026-48583

CVE-2026-48583 is a Windows kernel use-after-free vulnerability that enables a local privilege escalation by an authorized attacker. Sources confirm the issue and report CVSS v3.1 base score 7.8 (High) with LOCAL attack vector, LOW privileges required, no user interaction. The documents do not sp...

CVE-2026-58532

CVE-2026-58532 is a Windows Kernel elevation-of-privilege vulnerability: integer overflow/wraparound in the kernel could allow a local attacker to escalate privileges. Connected sources (NVD, EUVD/ENISA, CIRCL sightings) corroborate Windows Kernel impact and references to Microsoft security updat...

CVE-2026-61365

CVE-2026-61365: Windows Remote Desktop Services contains a missing-authentication flaw in a critical function that allows local privilege escalation by an authorized user. CVSS 3.1 baseline is 7.8 (HIGH); attack vector LOCAL, requires LOW privileges, no user interaction, and results in HIGH impac...

CVE-2026-62750

CVE-2026-62750 affects Windows HTTP Protocol Stack (http.sys). A partial string comparison vulnerability in the stack enables an unauthenticated attacker on an adjacent network to perform tampering. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates adjacent access with no privileges...

CVE-2026-62814

The CVE-2026-62814 entry pertains to an Integer underflow (wrap/wraparound) in Windows DHCP Server that allows an unauthorized attacker on an adjacent network to disclose information. The issue is described as an information disclosure vulnerability with an Adjacent attack vector and LOW attack c...

CVE-2025-29836

Technical details for CVE-2025-29836 (e.g., affected product, root cause, impact, or remediation) are not provided in the supplied connected documents. Please monitor for updates from official advisories.

CVE-2025-29967

Technical details about CVE-2025-29967 are not provided in the connected documents. Public details in the initial description exist, but no accompanying technical specifics (affected versions, root cause, exploit info, or remediation) are available here. Monitor for updates.

CVE-2025-48003

CVE-2025-48003 is a Windows BitLocker security feature bypass vulnerability described as a protection mechanism failure that allows an unauthorized attacker to bypass a security feature with a physical attack. The connected documents do not provide concrete technical details such as root cause, a...

CVE-2025-49685

CVE-2025-49685 is a local privilege-elevation vulnerability in the Microsoft Windows Search Component, caused by a use-after-free condition. The CVE is categorized with CVSS v3.1 base score 7.0 (HIGH), attack vector LOCAL, privilege required LOW, no user interaction, and affects Windows Search Co...

CVE-2025-54101

CVE-2025-54101: Use-after-free in Windows SMBv3 Client can lead to remote code execution by an authorized attacker over the network. The Connected documents confirm this SMBv3 Client issue and tie remediation to the September 2025 Windows updates that address SMB-related vulnerabilities (e.g., SM...

CVE-2026-20918

Technical details about CVE-2026-20918 are not publicly provided in the supplied documents. Monitor for updates from Microsoft and security advisories.

CVE-2026-47656

CVE-2026-47656 involves a vulnerability in Windows Boot Manager described as a protection mechanism failure that allows an authorized attacker to locally bypass a security feature. The associated CVSS 3.1 metrics indicate: Local attack vector, Low attack complexity, High privileges required, No u...

CVE-2026-50310

CVE-2026-50310 describes an integer overflow/wraparound in Windows Devices Human Interface which allows an authorized local attacker to disclose information. Affected component is the Windows Devices Human Interface; root cause is an overflow condition that can leak data locally. Microsoft has re...

CVE-2026-50470

CVE-2026-50470 describes an out-of-bounds read in Windows Network Policy Server SNMP that could let an unauthenticated attacker disclose information over the network. The vulnerability affects the NPS SNMP handling and has a CVSS v3.1 base score of 7.5 (High) with network attack vector, low attac...

CVE-2026-50509

CVE-2026-50509 is a Windows WWAN Service deserialization vulnerability that could enable local privilege escalation when an authorized user triggers the flaw. Affected component: Windows Wireless Wide Area Network Service (WwanSvc). Root cause: deserialization of untrusted data leading to elevati...

CVE-2026-61364

The CVE-2026-61364 entry concerns Windows Remote Desktop Services. A missing authentication flaw in a critical function enables a locally authenticated attacker with low privileges to elevate to higher privileges, as indicated by the CVSS 3.1 vector (L/L). Exploitation details or in-the-wild stat...

CVE-2025-21331

CVE-2025-21331 is a Windows Installer Elevation of Privilege vulnerability. The connected documents confirm it is a local privilege escalation (attack vector: LOCAL, requires LOW privileges and USER interaction) with high impact (C:H/I:H/A:H) per CVSS 3.1. Public details in the NCSC advisory cate...

CVE-2025-50173

CVE-2025-50173 is a Windows Installer local privilege-escalation vulnerability caused by weak authentication that enables an authenticated, local attacker to elevate privileges. The CVE is documented with a CVSS v3.1 base score of 7.8 (Impact: High; Privileges Required: Low; Scope: Unchanged; Loc...

CVE-2025-54107

CVE-2025-54107 involves the Windows MapUrlToZone component with improper resolution of path equivalence, enabling circumvention of a security feature over a network. The entry lists CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3, MEDIUM) and notes a network-exposed vector with no privileg...

CVE-2025-55680

CVE-2025-55680 concerns a TOCTOU race condition in the Windows Cloud Files Mini Filter Driver that can enable an authorized attacker to achieve local privilege escalation. The available connected docs confirm the affected component (Windows Cloud Files Mini Filter Driver) and the privilege impact...

CVE-2025-59507

CVE-2025-59507 affects Windows Speech and is described in connected materials as a race-condition‑driven vulnerability in a Windows Speech component that enables local privilege escalation for an authorized user. The provided sources note an elevated-privileges impact but do not specify the exact...

CVE-2026-20936

CVE-2026-20936 is an information-disclosure vulnerability in Windows NDIS (network data path). The issue is an out-of-bounds read in the NDIS driver that could allow an authorized attacker with physical access to disclose data. In the Nessus/NCSC/NVD entries, the CVE is flagged under Windows NDIS...

CVE-2026-25165

CVE-2026-25165 is a Windows local privilege escalation affecting Performance Counters. The description notes a local attack with low privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The underlying root cause and affected component details are not p...

CVE-2026-45603

The vulnerability CVE-2026-45603 affects Windows’ Ancillary Function Driver for WinSock (AFD). The issue is a use-after-free in the WinSock-related driver, leading to local privilege escalation for an authorized attacker. The CVSS3.1 assessment shows HIGH impact with LOCAL access, HIGH confidenti...

CVE-2026-49788

CVE-2026-49788 : An HTTP/2 denial-of-service vulnerability due to unbounded resource allocation allows an unauthenticated network attacker to exhaust resources and disrupt service. CVSSv3.1 base score 7.5 (HIGH); vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No product/vendor/version details are p...

CVE-2026-61920

CVE-2026-61920 – Windows DNS Server : A race condition caused by improper synchronization on a shared resource enables an authorized attacker to execute code over a network. Affected product: Windows DNS Server. Root cause: concurrent execution due to lack of proper synchronization in the shared ...

CVE-2026-65774

CVE-2026-65774 : Heap-based buffer overflow in the Windows Installer component allows an authorized, local attacker to elevate privileges. The issue is described as a local, low-attack-complexity vulnerability with high impact on confidentiality, integrity, and availability. No exploitation detai...

CVE-2026-65790

CVE-2026-65790 is a heap-based buffer overflow in Windows Message Queuing that enables an authorized, locally authenticated attacker to achieve elevation of privilege. Affected component: Windows Message Queuing; root cause: improper heap handling leading to a overflow condition. Impact: local pr...

CVE-2024-43558

CVE-2024-43558 is a Windows Mobile Broadband Driver Denial of Service vulnerability. Affected component: Windows Mobile Broadband Driver. Underlying impact: Denial of Service (availability impact stated). CVSSv3.1 base score 6.5 (Adjac ent attack vector, Low attack complexity, No privileges, No u...

CVE-2025-29956

Technical details (affected components, vulnerable versions, exploitability, and remediation) are not provided in the supplied documents. Monitor for updates from official advisories and vendor advisories for CVE-2025-29956.

CVE-2025-29958

Technical details about CVE-2025-29958 (uninitialized resource in RRAS) are not public in the provided documents. Monitor for vendor advisories and future updates.

CVE-2025-49667

Technical details about CVE-2025-49667 are not publicly provided in the supplied connected and initial documents. Monitor for updates from official advisories; current materials only indicate a local privilege escalation via Win32K ICOMP without specifics.

CVE-2026-24294

CVE-2026-24294 affects Windows SMB Server. The core issue is improper authentication in the SMB component, enabling an authorized local attacker to elevate privileges. The CVE is rated high (CVSS 3.1 base 7.8) with local attack vector, low complexity, and no user interaction required, and the imp...

CVE-2026-41097

CVE-2026-41097 describes a local security bypass in Windows Secure Boot caused by reliance on a non-updateable component. An authorized attacker could bypass a security feature locally. The CVE’s metrics show a medium base score (CVSS 3.1: 6.7; Local attack vector; high confidentiality/integrity/...