5098 matches found
CVE-2026-50426
CVE-2026-50426 : Windows DNS Server contains a relative path traversal vulnerability that could allow an authorized attacker on an adjacent network to execute code. Root cause is traversal of relative paths in DNS Server handling, enabling remote code execution. Reported impact is arbitrary code ...
CVE-2026-50489
CVE-2026-50489 is a heap-based buffer overflow in Windows Win32K that allows an authorized, locally authenticated attacker to escalate privileges. The root cause is a memory corruption in the Win32K subsystem that leads to code execution with SYSTEM rights. The CVE entry is supported by multiple ...
CVE-2026-50683
CVE-2026-50683 is a Windows DHCP Client/Server heap-based buffer overflow that enables an authenticated attacker on an adjacent network to elevate privileges. Public details in the initial entry cite a heap-based overflow and adjacent-access attack path with high impact (C:H, I:H, A:H) and a CVSS...
CVE-2026-50684
CVE-2026-50684 (AD FS spoofing) : The vulnerability is described as improper neutralization of input during web page generation (XSS) in Active Directory Federation Services, enabling an authorized attacker to perform spoofing over the network. The CVSS v3.1 base metrics indicate a Medium severit...
CVE-2026-58545
CVE-2026-58545 is a Windows Kernel Security Feature Bypass vulnerability. The connected documents confirm an improper access control in the Windows Kernel that could let an authorized locally attacker bypass a security feature. Metrics indicate CVSS v3.1 base score 5.5 (Medium), with Local attac...
CVE-2026-58546
CVE-2026-58546 is a Windows Remote Desktop Client Information Disclosure vulnerability. The initial and connected records confirm that the issue stems from use of an uninitialized resource in Windows RDP, enabling an unauthorized attacker to disclose information over a network. Affected component...
CVE-2026-62738
The vulnerability CVE-2026-62738 affects Windows Management Instrumentation and enables an authorized, local attacker to disclose information through an out-of-bounds read. The available descriptions consistently state information disclosure as the impact; no details on specific vulnerable binari...
CVE-2025-49660
Technical details about CVE-2025-49660 (affected product/component/version, root cause, impact, exploit status, or available patch) are not provided in the connected documents; monitor official disclosures for updates.
CVE-2025-49757
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2025-53801
CVE-2025-53801 is a Windows DWM core library elevation-of-privilege vulnerability described as an untrusted pointer dereference that enables a locally authenticated attacker to achieve elevation of privileges . The CVE is associated with a CVSS v3.1 base score of 7.8 (HIGH) with local attack vect...
CVE-2025-59244
CVE-2025-59244 affects Windows Core Shell and enables spoofing via external control of a file name or path over a network. It has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The vulnerability is listed under Windows Core Shell in the connected KB documents, and Microsoft ...
CVE-2025-60715
Technical details about CVE-2025-60715 (RRAS heap overflow, affected components, fixes) are not provided in the connected documents. Public technical specifics, affected versions, and remediation steps are not disclosed here; monitor for official updates.
CVE-2026-20812
CVE-2026-20812 is an LDAP tampering vulnerability in Windows LDAP (the Lightweight Directory Access Protocol) caused by improper input validation. The issue is exploitable by an authorized attacker over the network and primarily impacts data integrity (CVE CVSS indicates network access, low privi...
CVE-2026-20919
CVE-2026-20919 is a race-condition vulnerability in Windows SMB Server that allows an authorized network attacker to elevate privileges. The issue concerns concurrent access to a shared resource without proper synchronization. Public documentation in the connected sources confirms Windows SMB Ser...
CVE-2026-21253
CVE-2026-21253 is a Windows vulnerability in the Mailslot File System described as a use-after-free issue that can enable local privilege escalation. The CVE’s CVSS 3.1 score is 7.0 (HIGH) with a local attack vector, high attack complexity, and requires low privileges and no user interaction. The...
CVE-2026-32079
CVE-2026-32079 is a Web Account Manager information disclosure vulnerability with a CVSSv3.1 base score of 5.5 (MEDIUM). It is exploitable locally with low attack complexity and low privileges required; user interaction is not required. The confidentiality impact is HIGH, while integrity and avai...
CVE-2026-33100
CVE-2026-33100: Use-after-free in Windows Ancillary Function Driver for WinSock allows a locally authorized privilege escalation. The connected advisory set confirms the driver as affected and lists CVE-2026-33100 with a base CVSS v3.1 score of 7.0 (High) and local attack vector. Mitigation is vi...
CVE-2026-35415
Technical details about CVE-2026-35415 are not publicly available in the provided connected documents. Monitor for updates for specifics on affected products, impact, and mitigations once they are published.
CVE-2026-47654
CVE-2026-47654 is described as a heap-based buffer overflow in Remote Desktop Client enabling remote code execution over a network. The CVSS v3.1 metrics indicate NETWORK attack vector, HIGH impact on confidentiality, integrity, and availability, with NO privileges and UI interaction required. No...
CVE-2026-50294
CVE-2026-50294 : Windows Kernel exposes sensitive system information to an unauthorized control sphere, enabling a local attacker to disclose information. Documents confirm a local attack vector with high confidentiality impact; no exploitation details or remediation are provided in the connected...
CVE-2026-50325
Technical details (affected versions, root cause, remediation) are not provided in the supplied documents; monitor for updates.
CVE-2026-50359
CVE-2026-50359 is a Microsoft XML Core Services elevation-of-privilege vulnerability described as a use-after-free issue. The NVD/NCSC/CIRCL entries confirm local privilege escalation for an authorized user. No exploit vectors are provided in the documents. Microsoft has released updates addressi...
CVE-2026-50363
CVE-2026-50363 is a Windows Push Notifications elevation-of-privilege vulnerability characterized by a heap-based buffer overflow. An authorized, local attacker could escalate privileges. Microsoft has released updates addressing this (e.g., KB5095051 and MSRC/MSVC advisories) and recommends appl...
CVE-2026-50461
CVE-2026-50461 is a Windows NTFS heap-based buffer overflow vulnerability that allows a local attacker to execute code. The issue is linked to the NTFS subsystem, enabling arbitrary code execution with high impact (Local, Requires User Interaction, Privilege: None). Public records in NVD/EUVD/NCS...
CVE-2026-54987
CVE-2026-54987 is a Windows vulnerability described as a heap-based buffer overflow in the Windows Overlay Filter, enabling a locally authenticated attacker to elevate privileges. The CVSSv3.1 score is 7.8 (HIGH) with local attack vector, low attack complexity, and requires low privileges with no...
CVE-2026-56643
CVE-2026-56643 is a DirectX Graphics Kernel elevation of privilege vulnerability tracked by Microsoft. It stems from a use-after-free in the Windows Kernel’s DirectX Graphics Kernel component, enabling a local attacker with normal privileges to escalate to higher privileges. The vulnerability is ...
CVE-2026-62724
CVE-2026-62724 is a local privilege escalation affecting the Windows Telephony Service due to a use-after-free. An authorized attacker can elevate privileges locally. Root cause: use-after-free in Telephony service code; impact: high (local elevation of rights) per CVSS 3.1; exploitability and ex...
CVE-2026-65784
CVE-2026-65784 describes an out-of-bounds read in the Windows NTFS subsystem that allows an authorized local attacker to disclose information. The CVSS v3.1 base metrics assign a 5.5 (Medium) score with local attack vector , low attack complexity , and low privileges required , with no user inter...
CVE-2025-53806
CVE-2025-53806 describes a buffer over-read in Windows Routing and Remote Access Service (RRAS) that could allow an unauthenticated, remote attacker to disclose information over the network. The provided documents confirm the vulnerability description and network-exposure, but do not include expl...
CVE-2025-54111
CVE-2025-54111 is documented in the connected materials with concrete details: it involves a use-after-free in Windows UI XAML Phone DatePickerFlyout that can allow an attacker to elevate privileges locally. The NCSC-2025-0277 listing assigns a high severity (CVSS ~7.8–7.8 range) to CVE-2025-5411...
CVE-2025-55335
CVE-2025-55335 : A use-after-free in Windows NTFS leading to potential local privilege escalation. The initial entry notes local privileged impact but provides no concrete patch/version or workaround. Connected MSKBs describe OS update releases addressing various issues (KB5066793, KB5066835/7/ e...
CVE-2025-58736
CVE-2025-58736 is a use-after-free in Windows Inbox COM Objects that enables local code execution by an attacker who can interact with the affected system. CVSS v3.1: AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H; Privileges: None, User Interaction: Required, with high impact on confidentiality/ integrity/...
CVE-2025-59201
CVE-2025-59201 concerns Windows Network Connection Status Indicator (NCSI). The issue is described as improper access control that could allow a locally authenticated attacker to escalate privileges on affected Windows systems. Connected Microsoft security advisories (KB5066793, KB5066835–KB50668...
CVE-2026-20804
CVE-2026-20804 concerns an issue in Windows Hello where an incorrect privilege assignment can enable a local attacker to tamper with biometric authentication locally. The entry identifies the affected area as Windows Hello and the root cause as a privilege/permission misassignment, resulting in p...
CVE-2026-25172
CVE-2026-25172 concerns Windows Routing and Remote Access Service (RRAS). The RRAS integer overflow/wraparound vulnerability allows an authenticated attacker to execute code over a network. Connected advisories confirm this affects RRAS and note that Microsoft released updates to fix the vulnerab...
CVE-2026-33099
Technical details (affected products, root cause, vulnerable components, or exploitation specifics) are not publicly provided in the supplied documents. Monitor for updates from sources like MSRC and the CVE record.
CVE-2026-34344
Technical details about CVE-2026-34344 are not publicly provided in the supplied connected documents. The available descriptions are generic; monitor for official disclosures, patches, and affected products in subsequent updates.
CVE-2026-45636
The CVE-2026-45636 entries describe a heap-based buffer overflow in Windows NTFS that can allow an unauthenticated attacker to achieve local code execution. Affected software is Windows NTFS (filesystem driver). The underlying cause is a heap-based overflow; impact is high (CVE metrics show Local...
CVE-2026-49801
The CVE-2026-49801 entry concerns Windows SMB: an uninitialized resource within SMB handling can lead to local information disclosure by an authorized user. The attack is described as local with low privileges required and no user interaction, and the impact targets confidentiality (information d...
CVE-2026-50321
CVE-2026-50321 is a Windows USB Driver elevation-of-privilege vulnerability (race condition on a shared resource). An authorized, local attacker could exploit this to gain higher privileges on the affected system, per the NVD entry and cross-referenced sources. Connected advisories corroborate th...
CVE-2026-50388
CVE-2026-50388 is an Windows NTFS local vulnerability described as an out-of-bounds read that allows an unauthenticated/unauthorized attacker to execute code locally. The CVE is tracked across multiple sources (NVD, MSRC, CIRCL) with a base CVSS v3.1 score of 7.8 (High) and LOCAL attack vector, r...
CVE-2026-50422
CVE-2026-50422 is a Windows NTFS vulnerability described as an out-of-bounds read that could let an authenticated, local attacker gain elevated privileges. Affected component: Windows NTFS (NTFS subsystem). Root cause: out-of-bounds read in NTFS code path. Impact: local privilege escalation and p...
CVE-2026-50491
The CVE-2026-50491 entry documents an out-of-bounds read in the Code Integrity DLL (ci.dll) that enables an authorized local attacker to achieve Elevation of Privileges. Affected component: Windows Code Integrity mechanism (ci.dll). Root cause: out-of-bounds read in ci.dll leading to privilege es...
CVE-2026-56647
CVE-2026-56647 is a Windows vulnerability in the Windows Remote Access Service Infrastructure where an integer overflow/wraparound can let an authorized attacker elevate privileges over a network. The affected component is the Windows Remote Access Service Infrastructure, and the root cause is an...
CVE-2026-58638
CVE-2026-58638 is a Windows Boot Loader security feature bypass caused by a missing cryptographic step. The vulnerability allows a locally authenticated attacker to bypass a security feature. Public material in connected sources attributes the issue to Windows Boot Loader behavior and notes Micro...
CVE-2026-62740
CVE-2026-62740 describes a vulnerability in the Windows Imaging Component where an uninitialized resource can lead to local information disclosure by an authorized attacker. The issue is reported with a CVSS v3.1 base score of 5.5 (Medium), vector: Local, low attack complexity, and low privileges...
CVE-2026-65774
CVE-2026-65774 : Heap-based buffer overflow in the Windows Installer component allows an authorized, local attacker to elevate privileges. The issue is described as a local, low-attack-complexity vulnerability with high impact on confidentiality, integrity, and availability. No exploitation detai...
CVE-2025-53140
CVE-2025-53140 is a Windows Kernel Transaction Manager use-after-free vulnerability that could allow a locally authenticated attacker to elevate privileges. It affects the Kernel Transaction Manager component of Windows; root cause is a use-after-free flaw enabling local privilege escalation. The...
CVE-2025-53141
CVE-2025-53141 refers to a null pointer dereference in the Windows Ancillary Function Driver for WinSock that can enable local privilege escalation for an authenticated user. The connected Windows-ecosystem data identifies this CVE as affecting the WinSock ancillary driver with a high base severi...
CVE-2025-54094
CVE-2025-54094 is a local privilege escalation in the Windows Defender Firewall Service caused by a type confusion vulnerability. The connected documents confirm the affected component as Windows Defender Firewall Service and the impact as obtaining elevated privileges on the local machine. The s...