CVE-2026-72930

CVE-2026-72930 is a use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP) that allows an authorized attacker to execute code locally. The CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity, low privileges required, no user interaction, a...

CVE-2026-72966

CVE-2026-72966 affects Windows Remote Access Connection Manager , where a missing authorization check allows an already-authorized (low-privilege) local attacker to perform tampering without user interaction. The impact is rated HIGH for integrity with no effect on confidentiality or availability...

CVE-2026-73020

CVE-2026-73020 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability requires low privileges and no user interaction, with a CVSS 3.1 score of 7.8 (HIGH) and high impact to confidentiality, integrity, ...

CVE-2026-77886

CVE-2026-77886 is an out-of-bounds read in Windows DHCP Server that allows an unauthorized, network-based attacker to cause a denial of service . The vulnerability requires no user interaction or prior authentication, with a CVSS 3.1 score of 7.5 (HIGH) — driven entirely by the availability impac...

CVE-2026-84001

An out-of-bounds read vulnerability in Windows Key Distribution Center allows an unauthorized, remote attacker to cause a denial of service over the network. The flaw requires no privileges, no user interaction, and has low attack complexity, yielding a CVSS 3.1 score of 7.5 (HIGH) with high avai...

CVE-2026-62706

CVE-2026-62706 is an out-of-bounds read in Microsoft Windows Media Foundation that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , meaning exploitation requires user interaction but no prior au...

CVE-2026-62759

Windows Netlogon is affected by an authentication bypass by spoofing vulnerability (CVE-2026-62759). An unauthorized attacker on an adjacent network can perform spoofing, potentially leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.5 (HIGH) with an a...

CVE-2026-68832

CVE-2026-68832 is a local privilege escalation vulnerability in Windows NTFS caused by an integer overflow or wraparound . An authorized attacker with low privileges can exploit this with low complexity and no user interaction to achieve high impact on confidentiality, integrity, and availability...

CVE-2026-68837

CVE-2026-68837 is a use-after-free vulnerability in Windows File History Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity, low required ...

CVE-2026-68840

CVE-2026-68840 is a local privilege escalation vulnerability in the Windows USB Driver , caused by a race condition (concurrent execution using a shared resource with improper synchronization). An authorized attacker (low privileges, no user interaction) can exploit it locally with high complexit...

CVE-2026-68884

A heap-based buffer overflow in the Windows Kernel allows an authorized (low-privilege) local attacker to elevate privileges , per Microsoft's advisory (CVE-2026-68884). The vulnerability carries a CVSS v3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploit...

CVE-2026-68898

Windows iSCSI is vulnerable to an out-of-bounds read that allows an unauthorized, remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 6.5 (Medium) , with the attack requiring user interaction (e.g., opening a crafted file) but no prior privileges. CISA's SSVC assess...

CVE-2026-69349

CVE-2026-69349 is an information disclosure vulnerability in Windows Management Instrumentation (WMI) caused by use of an uninitialized resource . An authorized attacker can exploit it over a network to disclose information, with high confidentiality impact but no integrity or availability impact...

CVE-2026-69353

CVE-2026-69353 is an out-of-bounds read vulnerability in Windows Text Shaping that allows a locally authenticated attacker with low privileges to disclose information. The attack vector is local, requires no user interaction, and the scope is unchanged. The CVSS v3.1 base score is 5.5 (Medium) , ...

CVE-2026-69404

CVE-2026-69404 is a race condition in Windows TCP/IP caused by concurrent execution using a shared resource with improper synchronization, allowing an authorized local attacker (low privileges required) to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a local attack vector, high comp...

CVE-2026-69584

CVE-2026-69584 affects the Windows USB Video Driver , where an integer overflow or wraparound flaw allows an authorized attacker to elevate privileges locally . The Microsoft CNA assigns a CVSS 3.1 score of 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege ...

CVE-2026-69585

CVE-2026-69585 affects the Microsoft Windows Search Component , where an incorrect type conversion or cast allows an authorized attacker to perform local privilege escalation . The vulnerability scores 7.8 (HIGH) under CVSS 3.1, with low attack complexity, low privileges required, no user interac...

CVE-2026-69610

A buffer over-read in Windows Win32K (the kernel-mode component handling graphical subsystem operations) allows an authorized attacker with low privileges to achieve local privilege escalation . The vulnerability requires local access , has high attack complexity , and does not require user inter...

CVE-2026-69826

CVE-2026-69826 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve privilege escalation over a network . The CVSS 3.1 score is 8.0 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating an attacker with low privileges and user...

CVE-2026-70145

CVE-2026-70145 is an out-of-bounds read in the Microsoft Windows Search Component that allows an authorized attacker to disclose information locally. The vulnerability is rated CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, and no user interaction. The prim...

CVE-2026-70563

CVE-2026-70563 is an improper link resolution before file access ("link following") vulnerability in Windows Shell that allows an unauthorized attacker to perform spoofing over a network . The assigned CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating h...

CVE-2026-70565

CVE-2026-70565 is a use-after-free vulnerability in the Windows AF_UNIX Socket Provider that allows an authorized attacker to perform local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexit...

CVE-2026-72963

CVE-2026-72963 is a use-after-free vulnerability in Windows Modern Execution Server that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, low privileges required, and high impact on confidentiali...

CVE-2026-73000

CVE-2026-73000 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, no user interaction, and high impact to confide...

CVE-2026-77498

CVE-2026-77498 is an out-of-bounds read vulnerability in Windows DHCP Server that allows an unauthorized attacker to cause a denial of service over a network. The attack requires no privileges, no user interaction, and has low complexity, with a CVSS 3.1 score of 7.5 (HIGH) — the impact is limite...

CVE-2026-83989

CVE-2026-83989 is an out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver that allows an unauthenticated, remote attacker to cause a denial of service over a network. The vulnerability is rated CVSS 7.5 (HIGH) with a network attack vector, low complexity, no privileges or user int...

CVE-2026-85360

A use after free flaw in the Windows Kernel allows a local, authenticated attacker to elevate privileges . The vulnerability is scored CVSS 3.1 7.0 (HIGH) with a local attack vector , high attack complexity , low privileges required , and no user interaction , resulting in high impact to confiden...

CVE-2026-56172

CVE-2026-56172 is a use-after-free vulnerability in the Windows VHD miniport driver that allows an authorized local attacker to achieve privilege escalation . The CVSS 3.1 score is 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and full impact on...

CVE-2026-68875

CVE-2026-68875 is a buffer over-read in Windows NTFS that allows an authorized local attacker to achieve code execution . The vulnerability is rated CVSS 3.1 7.8 (High) with a local attack vector, low complexity, low privileges required, and no user interaction needed. No exploitation details or ...

CVE-2026-69298

CVE-2026-69298 is an elevation of privilege vulnerability in the Windows Biometric Service , caused by an integer overflow or wraparound . An attacker with low-level local privileges can exploit this to gain higher system privileges, with high impact on confidentiality, integrity, and availabilit...

CVE-2026-69310

CVE-2026-69310 is a use-after-free vulnerability in Windows DNS that allows an authorized attacker to elevate privileges locally. The flaw resides in the DNS component and requires local access with low privileges and no user interaction, though the attack complexity is rated as high. The CVSS 3....

CVE-2026-69352

CVE-2026-69352 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 7.8) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning an attacker with low privileges and no user intera...

CVE-2026-69393

CVE-2026-69393 is an out-of-bounds read in the Windows Spaceport.sys kernel driver that allows an authorized attacker to disclose information over a network . The vulnerability is rated CVSS 3.1: 5.7 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, reflecting that an attacker with l...

CVE-2026-69461

CVE-2026-69461 is a stack-based buffer overflow in Windows NTFS that allows an unauthorized, unprivileged attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior authentication, yielding a CVSS v3.1 score of 8.8 (HIGH) with full impact on...

CVE-2026-69466

CVE-2026-69466 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Windows Kernel that allows a low-privileged local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.0 (High) , with high impact to confidentiality, integrity, and availability, though explo...

CVE-2026-69583

Windows Biometric Service is affected by a heap-based buffer overflow that allows an authorized attacker to achieve local privilege escalation . The vulnerability carries a CVSS 3.1 base score of 7.8 (HIGH) , with local attack vector, low complexity, and low privileges required, resulting in high...

CVE-2026-69643

Windows Spaceport.sys (a system driver) contains a heap-based buffer overflow that allows an authorized attacker to escalate privileges over a network. The CVSS v3.1 score is 8.0 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity and required user interaction...

CVE-2026-69832

CVE-2026-69832 is an information disclosure vulnerability in Windows Win32K , a kernel-mode component handling graphics and input processing. Exposure of sensitive system information to an unauthorized control sphere allows a low-privilege local attacker to read sensitive data. The CVSS 3.1 score...

CVE-2026-72960

Windows Media Player is affected by a heap-based buffer overflow that allows an unauthorized, remote attacker to achieve code execution over a network . The attack requires user interaction (e.g., opening a crafted media file), but no prior privileges or elevated complexity. The assigned CVSS 3.1...

CVE-2026-72990

CVE-2026-72990 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability requires low privileges, no user interaction, and has low attack complexity, yet results in high impact across confidentiality, ...

CVE-2026-72992

A heap-based buffer overflow in the Windows Biometric Service allows an authorized local attacker to elevate privileges, resulting in high impact to confidentiality, integrity, and availability. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, a...

CVE-2026-72997

CVE-2026-72997 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker with low privileges and no user interaction to escalate privileges locally. The vulnerability is rated CVSS 3.1: 7.8 (HIGH) with high impact to confidentiality, integrity, and availabili...

CVE-2026-73015

CVE-2026-73015 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , requiring low privileges and no user interaction (vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)....

CVE-2026-78450

CVE-2026-78450 is a use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) that allows an unauthorized, network-based attacker to achieve remote code execution . The vulnerability was reported by Microsoft (CNA source) and assigned a CVSS 3.1 base score of 8.1 (H...

CVE-2026-83969

A heap-based buffer overflow in Windows Biometric Service allows an authorized attacker with low privileges to escalate privileges locally, resulting in high impact to confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector and no user interaction...

CVE-2026-83970

CVE-2026-83970 is a heap-based buffer overflow in Windows Biometric Service that allows an attacker with local access and low privileges to escalate to higher privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ). No user interaction is requir...

CVE-2026-68827

CVE-2026-68827 is an integer underflow (wrap or wraparound) vulnerability in Windows GDI+ that allows an authorized attacker to achieve elevation of privileges over a network . The vulnerability is rated HIGH severity (CVSS 8.0) with a vector of AV:N/AC:L/PR:L/UI:R, meaning exploitation requires ...

CVE-2026-69476

A heap-based buffer overflow in the Windows Biometric Service allows an authorized attacker to escalate privileges locally. The vulnerability is rated CVSS 7.8 (High) with low complexity and low privileges required, resulting in high impact to confidentiality, integrity, and availability. No spec...

CVE-2026-69589

CVE-2026-69589 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized, low-privilege attacker to achieve local privilege escalation . The vulnerability carries a CVSS v3.1 base score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low...

CVE-2026-69638

CVE-2026-69638 is a heap-based buffer overflow in Windows NTFS (New Technology File System) that allows an unauthorized attacker to execute code locally. The vulnerability requires no privileges and no user interaction, yielding a CVSS 3.1 base score of 8.4 (HIGH) with high impact to confidential...