CVE-2026-50451

CVE-2026-50451 affects Windows Routing and Remote Access Service (RRAS): missing authentication for a critical function enables local privilege escalation by an authorized attacker. Documented impact is privilege escalation (local), base CVSSv3.1 7.1 (HIGH); remediation is Microsoft security upda...

CVE-2026-57089

Summary : CVE-2026-57089 affects the Windows SMB Server Network Transport Driver (srvnet.sys). The issue is a use-after-free memory corruption bug that can be triggered by an unauthenticated attacker over the network to achieve remote code execution. The vulnerability is listed with high to criti...

CVE-2025-55683

CVE-2025-55683 — Windows Kernel Information Disclosure . The vulnerability is a local information disclosure in the Windows Kernel that could allow an authenticated/authorized attacker to disclose sensitive data. Current documentation assigns a low to moderate impact on confidentiality (CVSS v3.1...

CVE-2025-60706

According to the NCSC advisory, CVE-2025-60706 is a vulnerability in Windows Hyper-V where an out-of-bounds read can allow an authorized local attacker to disclose information (impact: access to sensitive data). The CVE is listed under Windows Hyper-V in the advisory with a CVSS v3.1 base score o...

CVE-2026-20939

CVE-2026-20939: Windows File Explorer information disclosure allowing a locally authenticated user to view sensitive data. The issue has a CVSSv3.1 base score of 5.5 (Local, Low attack complexity, Low privileges, Confidentiality impact: High). Microsoft has released fixes in January 2026 security...

CVE-2026-21239

CVE-2026-21239 describes a heap-based buffer overflow in the Windows Kernel. An authorized attacker can achieve local privilege escalation. The vulnerability is rated CVSS v3.1 base score 7.8 (HIGH) with LOCAL, low complexity, and no user interaction required beyond initial access, and it has hig...

CVE-2026-25168

CVE-2026-25168 is a Windows Graphics Component denial-of-service vulnerability. Exploitation requires local access with low complexity and no user interaction, and can cause an availability impact flagged as HIGH. The CVSSv3.1 score is 6.2 (MEDIUM overall) with an exploit that is unproven and rem...

CVE-2026-25171

Use-after-free in Windows at the level of Windows Authentication Methods allows an authorized attacker to elevate privileges locally. The vulnerability, CVE-2026-25171, is documented as a local privilege escalation in Windows Authentication Methods; exploitation requires the attacker to be locall...

CVE-2026-25175

CVE-2026-25175 is a Windows NTFS elevation of privilege vulnerability. The CVSS v3.1 base score is 7.8 (HIGH) with local attack vector, low attack complexity, and privileges required set to LOW. User interaction is NONE and the impact spans Confidentiality, Integrity, and Availability (HIGH/ HIGH...

CVE-2026-32083

CVE-2026-32083 pertains to Windows’ Simple Search and Discovery Protocol (SSDP) Service elevation of privilege. The vulnerability is local, with low privileges required and no user interaction, and yields a high impact on confidentiality, integrity, and availability. Microsoft lists an official f...

CVE-2026-33099

Technical details (affected products, root cause, vulnerable components, or exploitation specifics) are not publicly provided in the supplied documents. Monitor for updates from sources like MSRC and the CVE record.

CVE-2026-42975

CVE-2026-42975 affects the Windows Bluetooth Port Driver and is caused by a heap-based buffer overflow. This can allow an unauthenticated attacker to execute code on a target system over an adjacent network. The documented impact is high (remote code execution with full device compromise) and the...

CVE-2026-44806

CVE-2026-44806 : Windows Cryptographic Services vulnerability causing denial of service over the network due to missing release of memory after its effective lifetime. Affected component: Windows Cryptographic Services. Root cause described as missing memory release, leading to potential DoS. Rem...

CVE-2026-50431

Technical details are not publicly available in the provided documents. Monitor updates from Microsoft (MSRC) and advisories (NCSC, ZDI) for affected products, impact, and remediation related to CVE-2026-50431.

CVE-2026-50690

CVE-2026-50690 is a Windows SMB information-disclosure vulnerability described as caused by the use of an uninitialized resource within Windows SMB that can allow an authorized local attacker to disclose information. The CVE is linked to Microsoft advisories and MSRC updates addressing the issue,...

CVE-2026-56159

CVE-2026-56159 is a heap-based buffer overflow in Windows DHCP Server that can allow an unauthenticated attacker to execute code over a network (remote code execution). The vulnerability is rated CRITICAL with Network attack vector and no explicit exploit details in the provided documents. Connec...

CVE-2026-58545

CVE-2026-58545 is a Windows Kernel Security Feature Bypass vulnerability. The connected documents confirm an improper access control in the Windows Kernel that could let an authoriz­ed locally attacker bypass a security feature. Metrics indicate CVSS v3.1 base score 5.5 (Medium), with Local attac...

CVE-2026-58640

CVE-2026-58640 is a heap-based buffer overflow in Windows NTFS that enables an authorized local attacker to execute code. The vulnerability is tied to Windows NTFS logic and has a CVSS v3.1 score of 7.3 (HIGH) with local access required and user interaction. Affected component: Windows NTFS; root...

CVE-2025-62472

CVE-2025-62472 affects Windows Remote Access Connection Manager. The issue is described as an elevation of privilege vulnerability caused by use of an uninitialized resource, allowing an authorized local attacker to gain higher privileges. Microsoft’s December 2025 updates (e.g., KB5071501/KB5071...

CVE-2025-64680

CVE-2025-64680 affects Windows DWM Core Library. A heap-based buffer overflow allows an authorized, locally authenticated attacker to escalate privileges. The connected advisories/feeds confirm this CVE is part of Microsoft Windows vulnerability fixes and that Windows updates (KBs and security gu...

CVE-2026-20925

CVE-2026-20925 affects Windows NTLM and is described as an external control of the file name or path that enables spoofing (pretend to be another user) over a network. The vulnerability is assigned a CVSS v3.1 base score of 6.5 (Medium) with network attack vector and required user interaction. Co...

CVE-2026-20937

CVE-2026-20937 affects Windows File Explorer and is described as an information-disclosure vulnerability allowing a locally authorized attacker to disclose information. The provided documents confirm a Windows File Explorer exposure, with CVSS 3.1/5.5 (Local access, Low attack complexity, High co...

CVE-2026-21222

CVE-2026-21222 is a Windows Kernel information-disclosure vulnerability where insertion of sensitive data into a kernel log file could allow a locally authenticated attacker with LOW privileges to read sensitive data (CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The connected sources confirm t...

CVE-2026-26163

CVE-2026-26163 is a Windows Kernel elevation-of-privilege vulnerability described as a double free allowing an authorized local attacker to escalate privileges. Connected sources confirm the affected surface is Windows Kernel and the issue enables local privilege escalation with high impact. The ...

CVE-2026-33100

CVE-2026-33100: Use-after-free in Windows Ancillary Function Driver for WinSock allows a locally authorized privilege escalation. The connected advisory set confirms the driver as affected and lists CVE-2026-33100 with a base CVSS v3.1 score of 7.0 (High) and local attack vector. Mitigation is vi...

CVE-2026-33842

The CVE-2026-33842 entry describes a local information disclosure in Windows File Explorer. The vulnerability allows an authorized (low privileges) attacker to disclose sensitive information locally through the File Explorer component. Per the NVD entry, the impact is confined to confidentiality ...

CVE-2025-59510

Technical details about CVE-2025-59510 (RRAS in Windows) are not publicly provided in the supplied documents. Monitor for updates from Microsoft regarding affected products, impact, and remediation.

CVE-2025-59514

Technical details about CVE-2025-59514 are not provided in the supplied documents. No affected product versions, root cause, or remediation are specified here. Monitor for updates from official sources for confirmation and fixes.

CVE-2026-20827

CVE-2026-20827 affects the Tablet Windows User Interface (TWINUI) Subsystem, enabling local disclosure of sensitive information to an attacker with low privileges and no user interaction. The vulnerability is mapped to a local-attack vector with high confidentiality impact (C:H, I:N, A:N) and a C...

CVE-2026-20872

CVE-2026-20872 affects Windows NTLM: external control of a file name or path allows an attacker to spoof authentication over the network. The description states this vulnerability and related references indicate a Windows NTLM spoofing risk. The connected Nessus/NCSC/EUVD/NVD entries confirm the ...

CVE-2026-20932

CVE-2026-20932 is a Windows File Explorer information disclosure vulnerability with local access as the attack vector and a CVSS v3.1 base score of 5.5 (Medium). The connected advisories indicate the issue exists in Windows File Explorer and that Microsoft released January 2026 security updates; ...

CVE-2026-21508

CVE-2026-21508 concerns improper authentication in Windows Storage, enabling a locally authenticated attacker to elevate privileges. The CVSS v3.1 base score is 7.0 (HIGH), with LOCAL attack vector, HIGH impact on confidentiality, integrity, and availability, and a HIGH attack complexity requirin...

CVE-2026-24295

CVE-2026-24295 concerns the Windows Device Association Service Elevation of Privilege. The entry indicates a LOCAL attack with LOW privileges required and NO user interaction, leading to HIGH impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.0 (HIGH). The vulne...

CVE-2026-25174

CVE-2026-25174 is a Windows Privilege Elevation vulnerability described as an out-of-bounds read in the Windows Extensible File Allocation feature. The connected NCSC advisory confirms Microsoft has fixed vulnerabilities across Windows components, listing CVE-2026-25174 under Windows Extensible F...

CVE-2026-32075

CVE-2026-32075 affects Windows that uses the UPnP Device Host; vulnerability is Elevation of Privilege via a local vector. Requires LOW privileges and no user interaction, with high impact on confidentiality, integrity, and availability. Exploit code maturity is UNPROVEN; remediation is an offici...

CVE-2026-40378

CVE-2026-40378 affects Windows Local Security Authority Subsystem Service (LSASS). A memory allocation with an excessive size value can allow an unauthenticated attacker to cause a network-based denial of service. The CVSSv3.1 base score is 7.5 (HIGH). No exploitation details are provided in the ...

CVE-2026-49796

CVE-2026-49796 is a heap-based buffer overflow in Windows GDI+ that can let a local attacker execute code. Affected: Windows GDI+ component; root cause is a heap buffer overflow. Impact per CVSS: local attack with user interaction required, high confidentiality, integrity, and availability impact...

CVE-2026-21246

CVE-2026-21246 is a heap-based buffer overflow in the Microsoft Graphics Component that enables local privilege escalation for an authorized attacker. The CVSS 3.1 vector (LOCAL, LOW complexity, LOW privileges, NONE user interaction) yields a base score of 7.8 (HIGH impact on confidentiality, int...

CVE-2026-26175

CVE-2026-26175 : Windows Boot Manager security feature bypass via use of an uninitialized resource, enabling a physical attacker to bypass protection. Affected component: Windows Boot Manager; root cause: uninitialized resource handling. Base CVSS 3.1 score 4.6 (PHYSICAL attack, LOW attack comple...

CVE-2026-27909

CVE-2026-27909 is a Windows Search Component elevation-of-privilege vulnerability (use-after-free) that could allow an authenticated local attacker to gain SYSTEM privileges. Connected advisories confirm the issue and indicate Microsoft has fixed vulnerabilities across Windows components in April...

CVE-2026-41087

CVE-2026-41087 affects Windows File Explorer; a local attacker can cause exposure of sensitive information to obtain disclosure on the host. The vulnerability is rated CVSSv3.1: 5.5 (Medium) with Local access, Low attack complexity, Privileges Required: Low, no user interaction, and Confidentiali...

CVE-2026-49180

This CVE concerns the Universal Plug and Play component upnp.dll, where an improper link resolution before file access (link following) can lead to local information disclosure. The entry notes that an authorized attacker can disclose information locally, with a CVSS base score of 5.5 (Medium). A...

CVE-2026-49801

The CVE-2026-49801 entry concerns Windows SMB: an uninitialized resource within SMB handling can lead to local information disclosure by an authorized user. The attack is described as local with low privileges required and no user interaction, and the impact targets confidentiality (information d...

CVE-2026-50300

CVE-2026-50300 is an integer underflow in Windows Kernel (and related Windows components such as DWM Core Library per CVE listings) that enables an authorized local attacker to disclose information. The entry specifies a local attack vector with low privileges and no user interaction, causing a c...

CVE-2026-50455

CVE-2026-50455 describes an information disclosure in Universal Plug and Play (upnp.dll) caused by the use of an uninitialized resource. The vulnerability allows an authorized local attacker to disclose information. The reported impact shows confidentiality impact (C) as High, with local access a...

CVE-2026-50482

CVE-2026-50482 : Heap-based buffer overflow in Windows NTFS can allow a locally authenticated attacker to execute code. Exploitation requires local access with low privileges and user interaction, per the CVE metrics (AV:L, PR:L, UI:R). Public references indicate Microsoft has released updates to...

CVE-2026-50485

CVE-2026-50485 is a Windows Hyper-V Denial of Service vulnerability caused by a buffer over-read. It can be exploited by an attacker who has adjacent network access to deny service on the target host, with high privileges required and no user interaction. The documented impact is availability los...

CVE-2026-50647

CVE-2026-50647: AD FS denial-of-service due to an infinite loop in AD FS. Public sources (NVD/EUVD/NCSC, CIRCL sighting, MSRC) confirm a network-exploitable condition causing service disruption; no exploitation details provided in the docs. Microsoft has released updates addressing the vulnerabil...

CVE-2025-62213

Technical details about CVE-2025-62213 (affected component, root cause, impact, remediation) are not disclosed in the provided documents; no specifics on exploitability or affected products are available here; monitor for updates.

CVE-2025-62571

CVE-2025-62571 is a Windows Installer Elevation of Privilege vulnerability caused by improper input validation. The CVE affects Windows Installer, enabling an authorized, local attacker to escalate privileges (CVSS v3.1: 7.8, Local, Privileges Required: Low, User Interaction: None). Connected sou...