CVE-2026-33828

CVE-2026-33828 affects Windows Device Health Attestation (DHA). The vulnerability is a trust boundary violation in Windows Attestation that allows an authorized local attacker to elevate privileges. CVSS v3.1 base metrics indicate high impact to confidentiality, integrity, and availability with l...

CVE-2026-56188

CVE-2026-56188: A race-condition in the Windows Server Network driver (concurrent access to a shared resource) can allow an unauthenticated attacker to execute code over the network. The vulnerability affects the Windows Server Network driver and is described as a remote code execution flaw with ...

CVE-2024-38155

Technical details about CVE-2024-38155 are not publicly provided in the connected documents. The available sources only identify the vulnerability name and general context. Monitor for updates from official advisories to obtain affected products, impact, and fixes.

CVE-2025-21230

CVE-2025-21230 is a Denial-of-Service vulnerability in Microsoft Message Queuing (MSMQ). Connected CNVD entries explicitly describe a vulnerability in MSMQ that can be exploited to cause a DoS on the system, aligning with the CVSS vector in the CVE entry (Network, Privileges=None, User interactio...

CVE-2026-50425

CVE-2026-50425: A use-after-free in Windows Internal System User Profile leads to local privilege escalation for an authorized attacker. Affected component: Windows Internal System User Profile; root cause: use-after-free; impact: gain high privileges locally with no user interaction (CVSSv3.1: A...

CVE-2025-24996

CVE-2025-24996 : Affects Windows NTLM. External control of a file name or path enables an unauthorized network spoofing scenario, potentially allowing impersonation over a network. CVSSv3.1 base 6.5 (Network attack, low complexity, no privileges required, user interaction required; CIA: high conf...

CVE-2026-48576

CVE-2026-48576 is a Windows Secure Boot vulnerability described as a protection mechanism failure enabling a local attacker with high privileges to bypass a security feature. The available documents specify a local attack vector with low complexity and no user interaction, and a base CVSS 3.1 sco...

CVE-2026-42978

CVE-2026-42978: A race condition due to improper synchronization in Windows Push Notifications leads to local privilege escalation for an authorized attacker. The CVSSv3.1 base score is 7.8 (LOCAL, HIGH impact on confidentiality, integrity, and availability) with HIGH attack complexity and LOW pr...

CVE-2025-21204

CVE-2025-21204 affects Windows Update Stack with improper link resolution before file access, enabling local privilege elevation for an authenticated user. Public documentation confirms the vulnerability and that Microsoft released fixes as part of April 2025 updates; patches include OS updates t...

CVE-2026-33829

CVE-2026-33829 concerns the Windows Snipping Tool and is assigned a CVSSv3.1 base score of 4.3 (Medium). The vulnerability is described with a network attack vector but requires user interaction and does not affect integrity or availability, with confidentiality impact listed as Low. The metric i...

CVE-2026-42980

The CVE-2026-42980 entry describes an integer underflow (wrap or wraparound) in the Windows NT OS Kernel that allows an authorized, local attacker to elevate privileges. Affected component: Windows NT OS Kernel; root cause: numeric underflow leading to improper bounds/flow control, enabling privi...

CVE-2025-60724

Technical details about CVE-2025-60724 are not provided in the supplied documents. Connected KBs discuss OS updates and security fixes but do not specify vulnerable product versions, root cause, exploitation, or patch specifics for this CVE. Monitor for updates.

CVE-2025-24076

CVE-2025-24076 affects the Windows Cross Device Service, enabling local privilege escalation via improper access control. Public material confirms a local, low-privilege attacker can escalate to SYSTEM by exploiting DLL handling in the Cross Device Service (e.g., by replacing CrossDevice.Streamin...

CVE-2026-45585

CVE-2026-45585 concerns a Windows security feature bypass publicly referred to as “YellowKey.” The CVE entry notes a mitigation path provided by Microsoft to protect against the vulnerability until an update is released. The CVSSv3.1 metrics indicate a MEDIUM base score (6.8) with physical attack...

CVE-2024-43513

CVE-2024-43513 is a BitLocker security feature bypass vulnerability affecting Windows BitLocker. The entry notes a bypass of security measures with a CVSS v3.1 base score of 6.4 (Physical access, High impact for confidentiality, integrity, and availability). The connected Microsoft update guidanc...

CVE-2026-65773

CVE-2026-65773 concerns improper access control in Windows Kernel, enabling a locally authenticated attacker to elevate privileges. Affected software/component: Windows Kernel (details not expanded in provided documents). Root cause: incorrect access control checks; impact: local privilege escala...

CVE-2026-20846

CVE-2026-20846 describes a buffer over-read in Windows GDI+ that can be exploited over a network to cause a denial of service. The CVSS v3.1 base score is 7.5 (HIGH). Mitigation requires the Microsoft update per the MSRC vulnerability entry CVE-2026-20846.

CVE-2026-44803

CVE-2026-44803 describes an integer overflow/wraparound in Windows Win32K - GRFX that can allow a local attacker to execute code. The vulnerability is identified across multiple sources (NVD, CVE listing, and MSRC update page) and is classified with a high impact: local code execution, requiring ...

CVE-2025-47827

In IGEL OS versions prior to 11, a cryptographic signature verification vulnerability in the igel-flash-driver module allows for a Secure Boot bypass . An attacker can leverage this flaw to mount a crafted root filesystem from an unverified SquashFS image, compromising the system's chain of trust...

CVE-2026-62727

A race condition in Windows Telephony Service allows a locally authenticated low-privilege attacker to elevate privileges to SYSTEM. CVSS 3.1 base score 7.0 (HIGH). Microsoft has published an update guide; apply the patch from the MSRC link. No exploitation details or in-the-wild activity are pro...

CVE-2026-57089

Summary : CVE-2026-57089 affects the Windows SMB Server Network Transport Driver (srvnet.sys). The issue is a use-after-free memory corruption bug that can be triggered by an unauthenticated attacker over the network to achieve remote code execution. The vulnerability is listed with high to criti...

CVE-2025-21263

Technical details for CVE-2025-21263 are not publicly provided in the supplied connected documents. The materials reference Windows Digital Media Elevation of Privilege vulnerability but do not describe affected components, root cause, impact specifics, or fixes. Monitor updates from official sou...

CVE-2024-49084

CVE-2024-49084 is a Windows Kernel elevation-of-privilege issue (Windows Kernel). The connected sources list it under Windows Kernel with a CVSS v3.1 base score of 7.0 (local attack vector, high impact across confidentiality, integrity, and availability) and indicate the vulnerability allows obta...

CVE-2026-58594

CVE-2026-58594 is a Windows Remote Desktop Client RCE vulnerability caused by an integer overflow/wraparound in the RDP client. Public sources (NVD/NCSC/CIRCL) attribute network-based exploitation with potential arbitrary code execution on vulnerable Windows systems. Connected entries confirm the...

CVE-2026-62781

CVE-2026-62781 is a heap-based buffer overflow in the RPC Runtime Library that enables remote code execution over the network. The vulnerability allows an unauthenticated attacker to run code on affected systems via network interaction. Current documents confirm the issue but do not provide produ...

CVE-2024-38153

CVE-2024-38153 is a Windows Kernel elevation-of-privilege vulnerability. The CVSSv3.1 base score is 7.8 (High) with Local attack vector, Low attack complexity, Privileges Required: Low, User Interaction: None, and impact on Confidentiality, Integrity, and Availability: High. The vulnerability aff...

CVE-2026-23670

CVE-2026-23670 affects Windows Virtualization-Based Security (VBS) security feature. The issue is a local, high-privilege bypass of VBS protections, with no user interaction required (UI: NONE). Exploitation is possible with local access and may impact confidentiality and integrity (both HIGH), w...

CVE-2026-26128

CVE-2026-26128 concerns an elevation-of-privilege flaw in Windows SMB Server caused by improper authentication. The vulnerability affects Windows SMB Server and is described in connected sources as allowing an authorized local attacker to obtain higher privileges. Evidence from the connected docu...

CVE-2026-61929

CVE-2026-61929 is a Windows kernel vulnerability described as a use-after-free that could allow an authorized local attacker to achieve privilege escalation. The available sources confirm the affected component is the Windows kernel, with a local attack vector and high impact on confidentiality, ...

CVE-2025-21302

CVE-2025-21302 is a Windows Telephony Service Remote Code Execution vulnerability. The CVSS 3.1 base score is 8.8 (HIGH) with network access, low attack complexity, no privileges required, and user interaction required; impacts include confidentiality, integrity, and availability. The vulnerabili...

CVE-2025-24044

CVE-2025-24044 is a local privilege-escalation in the Windows Win32 Kernel Subsystem caused by a use-after-free condition. Connected docs classify it as an EoP risk with local exploitability and note fixes in Microsoft Windows updates (e.g., March 2025 cycle). No product/version specifics beyond ...

CVE-2026-50343

CVE-2026-50343, a Microsoft Install Service Elevation of Privilege vulnerability, arises from improper privilege management. An authorized local attacker could elevate privileges on affected Windows systems. The vulnerability is listed among several critical Windows privilege-escalation issues di...

CVE-2024-49082

CVE-2024-49082 is a Windows File Explorer information disclosure vulnerability. The connected data lists impact as access to sensitive data with CVSS 3.1 v3.1 vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, score 6.8 (Medium). Concrete details about root cause or affected Windows versions are not fu...

CVE-2025-21351

CVE-2025-21351 is a Windows AD DS API Denial of Service vulnerability. The initial record notes a network‑vector DoS impacting AD DS APIs with a CVSS v3.1 base score of 7.5 (HIGH) and no user interaction required. Connected documents indicate Microsoft has released updates addressing vulnerabilit...

CVE-2026-49160

The CVE-2026-49160 entry concerns HTTP.sys with an HTTP/2 resource consumption flaw leading to unauthenticated denial of service over the network. Exploitation details, affected versions or specific component paths aren’t provided in the connected documents. The NVD/MSRC entries confirm an uncont...

CVE-2024-38199

Technical details about CVE-2024-38199 are not publicly provided in the connected documents. Monitor for updates from Microsoft and NVD for affected products, fixes, and exploit information.

CVE-2026-59131

Summary: CVE-2026-59131 pertains to AMD Zen and is described as an information-disclosure vulnerability that can be exploited by an authorized, local attacker to disclose information. The available documents indicate a CVSS v3.1 base score of 5.6 (Medium) with LOCAL attack vector, HIGH confidenti...

CVE-2025-24035

CVE-2025-24035 affects Windows Remote Desktop Services. The connected data corroborates a remote code execution risk over a network, arising from memory handling (sensitive data stored in improperly locked memory). The impact is described as executing arbitrary code, with the network as the attac...

CVE-2026-40369

CVE-2026-40369 is a Windows Kernel elevation of privilege vulnerability described as an untrusted pointer dereference that could allow an authorized, local attacker to elevate privileges. Connected documents confirm this is affecting Windows kernel components across Windows 11 (versions in 25H2/2...

CVE-2024-38144

CVE-2024-38144 is a local elevation-of-privilege vulnerability in the Windows Kernel Streaming WOW Thunk Service Driver. The connected sources state a local attacker could obtain SYSTEM privileges and that exploit code appeared in the TyphoonPWN 2024 event, with a write‑up from SSD Secure Disclos...

CVE-2024-43625

CVE-2024-43625 is a Microsoft Windows VMSwitch elevation-of-privilege vulnerability (CVSSv3.1: 8.1, LOCAL, no user interaction). Affected component is the Windows VMSwitch; the exposed impact is potential total compromise with high confidentiality, integrity, and availability impact. Publicly dis...

CVE-2024-49072

Technical details about CVE-2024-49072 are not publicly available in the provided documents. Monitor for updates from official advisories; no covered exploit specifics, affected products, versions, or mitigations are provided here.

CVE-2026-42970

CVE-2026-42970 involves Windows Push Notifications and is caused by the use of an uninitialized resource , enabling an authorized attacker to locally disclose information. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) yields a base score of 5.5 (Medium) with high confidentiality impac...

CVE-2026-59126

The CVE refers to a race condition in Windows Event Logging Service where concurrent execution on a shared resource with improper synchronization can enable a local, authorized user to elevate privileges. Affected component: Windows Event Logging Service; root cause: race condition due to insuffi...

CVE-2024-43533

CVE-2024-43533 is a Windows Remote Desktop Client remote code execution vulnerability. The CVSS 3.1 base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8 (HIGH), with network attack vector, no privileges required, and user interaction needed. Nessus and MSRC entries associat...

CVE-2024-49132

CVE-2024-49132 affects Windows Remote Desktop Services and is a remote code execution vulnerability exploitable over the network (attack vector: network; no privileges required; user interaction not needed). The CVSSv3.1 base score is 8.1 (HIGH) with high impact on confidentiality, integrity, and...

CVE-2025-21377

Technical details for CVE-2025-21377 are not publicly provided in the supplied documents. No affected products, root cause, impact, or remediation are specified here. Monitor for updates in the connected feeds.

CVE-2026-54124

CVE-2026-54124 – Windows Terminal RCE via integer overflow . The vulnerability is an integer overflow/wraparound in Windows Terminal that can allow a local attacker to execute code on the target system. Public sources in the provided set confirm this CVE refers to Windows Terminal and describe th...

CVE-2026-62795

CVE-2026-62795 is a Windows LDAP (Lightweight Directory Access Protocol) use-after-free vulnerability that allows a remote attacker to execute code over the network. The issue is described as a remote code execution in Windows LDAP due to a use-after-free condition, enabling an unauthenticated, n...

CVE-2026-40400

CVE-2026-40400 is a Windows PowerShell relative path traversal vulnerability that could enable an authorized attacker to execute code over a network. The CVE entry identifies a remote code execution risk with NETWORK attack vector, LOW attack complexity, and LOW privileges required, but with UI i...