CVE-2026-50427

CVE-2026-50427 affects Content Delivery Manager. Description: use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVSS v3.1: 7.8 (Local, Low user interaction, Privilege Escalation, high impact on confidentiality, integrity, availability). Connected sourc...

CVE-2026-50688

CVE-2026-50688 is a Windows Win32k elevation-of-privilege vulnerability described as a use-after-free in the Win32k subsystem that allows a locally authenticated attacker to gain higher privileges. The connected documents confirm the CVE title and its Windows kernel context, with advisories and C...

CVE-2025-47980

Technical details about CVE-2025-47980 (affected product/components, root cause, impact, fixes) are not provided in the connected documents. Monitor for updates as more information becomes public.

CVE-2025-49659

Technical details for CVE-2025-49659 are not present in the provided connected documents. Public information about affected products, root cause, exploit status, and fixes is not available here; monitor for updates from official advisories.

CVE-2025-49722

Technical details about CVE-2025-49722 are not present in the provided documents. No affected products, root cause, exploit vector, or fixes are disclosed here. Monitor for updates and consult the primary CVE entry for authoritative information.

CVE-2025-55229

CVE-2025-55229 concerns improper verification of cryptographic signatures in Windows Certificates, enabling a network attacker to spoof over the network. The primary root cause is flawed verification during certificate handling, with the CVSS data indicating network access, low attack complexity,...

CVE-2026-20842

CVE-2026-20842 is a Windows elevation-of-privilege vulnerability in the Desktop Window Manager (DWM) due to a use-after-free in the DWM core library. Exploitation would be local (requiring prior authentication) and could grant total compromise of the affected system, as described in the CVE entry...

CVE-2026-20936

CVE-2026-20936 is an information-disclosure vulnerability in Windows NDIS (network data path). The issue is an out-of-bounds read in the NDIS driver that could allow an authorized attacker with physical access to disclose data. In the Nessus/NCSC/NVD entries, the CVE is flagged under Windows NDIS...

CVE-2026-24296

CVE-2026-24296 affects Windows Device Association Service, where concurrent execution on a shared resource with improper synchronization (race condition) enables a local, authorized attacker to elevate privileges. The issue is documented across multiple sources (NVD/NCSC/ENISA/CVEs listing) with ...

CVE-2026-27906

Summary: CVE-2026-27906 (Windows Hello) is a local security feature bypass caused by improper input validation, enabling an authenticated user with high privileges to bypass a security feature. The vulnerability affects Windows Hello components and has an indicative CVSSv3.1 base score of 4.4 (At...

CVE-2026-32074

CVE-2026-32074 concerns the Windows Projected File System (ProjFS) Elevation of Privilege. The vulnerability is local: attack vector Local, requires LOW privileges, with LOW attack complexity and no user interaction. It impacts confidentiality, integrity, and availability (all HIGH). The CVSS 3.1...

CVE-2026-32163

CVE-2026-32163 corresponds to a race condition in Windows User Interface Core that can allow an authorized local attacker to elevate privileges. The confluence of connected advisories confirms this CVE is tracked as affecting Windows UI Core, with a CVSS v3.1 score of 7.8 (LOCAL, HIGH impact on c...

CVE-2026-50357

CVE-2026-50357 affects Windows Resilient File System (ReFS). The issue is a numeric truncation error in ReFS that, per the provided documents, can enable an authorized attacker to execute code locally. The MSRC/MSVCN details list this as an elevation of privileges / local arbitrary code execution...

CVE-2026-50415

CVE-2026-50415 affects Windows Media. The issue is exposure of sensitive information to an unauthorized actor over a network, enabling information disclosure. NVD and other sources describe a network-available impact with high confidentiality impact (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

CVE-2026-50471

CVE-2026-50471 is a heap-based buffer overflow in Windows NTFS that could allow a local attacker to execute arbitrary code. The vulnerability affects Windows NTFS components as described in multiple sources (NVD/NCSC/CIRCL) and is being addressed by Microsoft with published updates (e.g., KB arti...

CVE-2026-50498

CVE-2026-50498 affects the Windows Universal Disk Format File System Driver (UDFS) and is an Elevation of Privilege vulnerability in the UDFS component. The root cause is described as a privilege/escalation condition within the Windows UDFS driver, leading to local privilege escalation with a hig...

CVE-2026-58531

CVE-2026-58531 is a Windows SMB elevation-of-privilege vulnerability caused by a race condition in a shared resource. It affects Windows SMB components and enables an authorized attacker to elevate privileges over the network. CVSS v3.1 base score 7.5 (NETWORK, HIGH impact), per Microsoft’s advis...

CVE-2026-61355

A heap-based buffer overflow in Windows Sensor Data Service allows an authorized local attacker to elevate privileges. Affected component: Windows Sensor Data Service. Vulnerability type: heap-based overflow. Impact: elevated local privileges with high confidentiality, integrity, and availability...

CVE-2026-61921

This CVE describes an out-of-bounds read in Windows Remote Desktop Client that allows an unauthenticated attacker to disclose information over a network, impacting confidentiality (C:H) with CVSS 6.5 (Network, Low complexity, User interaction required). No exploitation details are provided in the...

CVE-2025-29830

Technical details about CVE-2025-29830 are not provided in the connected documents. The available data only notes a RRAS information disclosure vulnerability. Monitor official sources for updates on affected products, root cause, and remediation.

CVE-2026-25165

CVE-2026-25165 is a Windows local privilege escalation affecting Performance Counters. The description notes a local attack with low privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The underlying root cause and affected component details are not p...

CVE-2026-32162

CVE-2026-32162 is a Windows COM elevation of privilege vulnerability with local access, no user interaction, and high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.4 (HIGH) with exploit code maturity labeled UNPROVEN and remediation level OFFICIAL_FIX. Affec...

CVE-2026-32181

The CVE-2026-32181 entry describes a Denial of Service vulnerability in the Connected User Experiences and Telemetry Service. According to the metrics, it is a LOCAL, low-complexity attack requiring LOW privileges with no user interaction, and it can cause an availability impact (CVSSv3.1 base sc...

CVE-2026-32209

Technical details (affected components, exploit vectors, root cause, vulnerable versions, and fixes) are not publicly provided in the supplied documents. Monitor official updates from NVD/CVE for further information.

CVE-2026-41088

CVE-2026-41088 affects Windows: External control of file name or path in the Windows Ancillary Function Driver for WinSock can allow an authorized local user to elevate privileges. The available connected records corroborate the issue description (Windows WinSock driver path/name control enabling...

CVE-2026-50682

CVE-2026-50682 describes an out-of-bounds read in Windows Active Directory (Active Directory Domain Services) that can allow an authorized attacker to cause a denial of service over the network. The description and cross-references in the connected documents confirm the affected component as Wind...

CVE-2026-54125

CVE-2026-54125 affects Windows Runtime and describes a race-condition vulnerability in concurrent execution on a shared resource that enables local privilege elevation for an authenticated attacker. The CVE is rated with CVSSv3.1 base metrics: AV Local, AC Low, PR Low, UI None, S unchanged, C/H/I...

CVE-2026-65798

CVE-2026-65798 corresponds to a numeric truncation error in Windows DNS that enables an authorized attacker to perform local privilege escalation. Affected component: Windows DNS. Root cause: numeric truncation in DNS handling leading to elevated privileges. Impact is described as local elevation...

CVE-2025-29832

Technical details about CVE-2025-29832 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are detailed here. Monitor for updates.

CVE-2025-47982

CVE-2025-47982 affects Windows Storage VSP Driver. The root cause is improper input validation, enabling a locally authenticated attacker to elevate privileges. CVSS v3.1 base score 7.8 (HIGH) with local, low-complexity, no user interaction required; impact includes high confidentiality, integrit...

CVE-2025-49682

CVE-2025-49682 is a Windows Media use-after-free vulnerability that enables a locally authenticated attacker to elevate privileges. The published entries confirm a local-privilege-escalation impact without remote code execution. Microsoft has released updates (e.g., KB 5062570/5062572/5062552–506...

CVE-2025-49730

Technical details about CVE-2025-49730 are not publicly available in the provided connected documents. Monitor for updates from official advisories; no information on affected products, root cause, or fixes is provided here.

CVE-2026-20861

CVE-2026-20861 describes a race condition in Windows Management Services that allows an authorized, local attacker to elevate privileges. The connected documents corroborate that this CVE is associated with Windows Management Services and appears in Microsoft‑affecting security updates released J...

CVE-2026-20871

CVE-2026-20871 refers to a Desktop Window Manager (dwm.exe) use-after-free vulnerability that enables local privilege escalation to SYSTEM. The connected exploit report and advisories describe a DWM-related attack path (Visual‑Field Singularity) affecting the DWM compositor, with PoC/claims of in...

CVE-2026-27920

CVE-2026-27920 is a Windows vulnerability in the UPnP Device Host that enables a local privilege escalation . The entry indicates a local attack vector with low required privileges and no user interaction, leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 base s...

CVE-2026-34336

Technical details (affected product/version, root cause, exploit information, or patch specifics) are not provided in the supplied documents. Monitor for updates as public details may be released separately.

CVE-2026-40409

Technical details for CVE-2026-40409 are not publicly available in the provided documents. Monitor for updates from Microsoft/NVD for affected products, root cause, impact, and remediation.

CVE-2026-40414

CVE-2026-40414 describes a null pointer dereference in the Windows TCP/IP stack that can cause a denial of service over an adjacent network. Affected software is Windows TCP/IP; root cause is a null pointer dereference. Impact is limited to availability (denial) with no confidentiality or integri...

CVE-2026-42984

CVE-2026-42984 relates to a use-after-free in the Windows Kernel enabling an authorized local attacker to elevate privileges. Affected component: Windows Kernel. Underlying cause: use-after-free (exact technical details not provided here). Impact: local privilege elevation with high confidentiali...

CVE-2026-50348

CVE-2026-50348 describes a race condition in Windows Runtime where concurrent execution using a shared resource with improper synchronization can allow an unauthenticated attacker to elevate privileges over a network. The description and publicly visible details indicate the vulnerability affects...

CVE-2026-50372

CVE-2026-50372 — Windows Redirected Drive Buffering : A buffer over-read vulnerability in Windows Redirected Drive Buffering could allow an authorized, local attacker to elevate privileges. The CVE is corroborated by multiple sources (NVD, MSRC, EUVD/ENISA, CIRCL sighting) with an incident descri...

CVE-2026-50494

CVE-2026-50494 is a Windows NTFS vulnerability caused by a heap-based buffer overflow in NTFS handling that can let an authorized, local attacker execute code on the host. The issue affects Windows NTFS components and is being addressed by Microsoft security updates (e.g., KB5099539, KB5099540) r...

CVE-2026-61364

The CVE-2026-61364 entry concerns Windows Remote Desktop Services. A missing authentication flaw in a critical function enables a locally authenticated attacker with low privileges to elevate to higher privileges, as indicated by the CVSS 3.1 vector (L/L). Exploitation details or in-the-wild stat...

CVE-2026-61365

CVE-2026-61365: Windows Remote Desktop Services contains a missing-authentication flaw in a critical function that allows local privilege escalation by an authorized user. CVSS 3.1 baseline is 7.8 (HIGH); attack vector LOCAL, requires LOW privileges, no user interaction, and results in HIGH impac...

CVE-2026-62700

CVE-2026-62700 describes a heap-based buffer overflow in Windows NTFS that allows an authenticated, local attacker to elevate privileges. The vulnerability affects the NTFS component on Windows and is rated CVSSv3.1#3.1 with a base score of 7.8 (HIGH) and local attack vector/low complexity, requi...

CVE-2026-62730

CVE-2026-62730 describes a buffer over-read in the Windows Wired AutoConfig Service that can disclose information locally. The issue is exploitable by an authorized, low-privilege local attacker (LOCAL attack vector, LOW privileges, no user interaction) with a CVSS v3.1 base score of 5.5 (HIGH co...

CVE-2026-65790

CVE-2026-65790 is a heap-based buffer overflow in Windows Message Queuing that enables an authorized, locally authenticated attacker to achieve elevation of privilege. Affected component: Windows Message Queuing; root cause: improper heap handling leading to a overflow condition. Impact: local pr...

CVE-2025-48815

CVE-2025-48815 affects Windows OS via a type confusion in the SSDP Service that could allow an authorized local attacker to elevate privileges. The description states local privilege escalation with high impact (CVSSv3.1: 7.8, HIGH). No explicit exploitation details or vendor/product versions are...

CVE-2025-48818

CVE-2025-48818 is a TOCTOU race condition in Windows BitLocker that enables bypass of a security feature via physical access. The CVE is listed in NCSC/NCSC-2025-0213 with impact described as bypassing security measures under Windows BitLocker and a CVSS v3.1 base score of 6.8 (PHYSICAL vector, L...

CVE-2025-49664

Technical details about CVE-2025-49664 (affected components, root cause, impact, or remediation) are not provided in the connected documents. Monitor official advisories and vendor patch notes for authoritative information and fixes.