CVE-2026-50509

CVE-2026-50509 is a Windows WWAN Service deserialization vulnerability that could enable local privilege escalation when an authorized user triggers the flaw. Affected component: Windows Wireless Wide Area Network Service (WwanSvc). Root cause: deserialization of untrusted data leading to elevati...

CVE-2026-50670

CVE-2026-50670 is a Windows Win32k elevation-of-privilege vulnerability caused by an out-of-bounds read in the Windows kernel. Connected sources confirm local privilege escalation potential and indicate Microsoft has released updates (e.g., KB5099538/KB5099540; MSRC guidance) addressing this issu...

CVE-2026-50688

CVE-2026-50688 is a Windows Win32k elevation-of-privilege vulnerability described as a use-after-free in the Win32k subsystem that allows a locally authenticated attacker to gain higher privileges. The connected documents confirm the CVE title and its Windows kernel context, with advisories and C...

CVE-2026-62692

CVE-2026-62692 : Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 vector is LOCAL, LOW exploitability with NONE user interaction and impact on Confidentiality, Integrity, Availability (HIGH) ; base sco...

CVE-2026-69603

CVE-2026-69603 is a heap-based buffer overflow in Windows Hyper-V that allows an authorized local attacker to achieve code execution . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low privileges required, no user interaction, and changed scope leading to high impact on confident...

CVE-2020-1158

Technical details for CVE-2020-1158 are not provided in the connected documents; the sources reference the vulnerability at a high level and mostly discuss related CVEs. Monitor for updates.

CVE-2026-26180

CVE-2026-26180 is a Windows kernel local elevation of privilege issue. The vulnerability affects the Windows kernel with a local attacker able to gain HIGH impact on confidentiality, integrity, and availability. Exploitation is LOCAL with LOW complexity and LOW privileges required, and no user in...

CVE-2026-41092

CVE-2026-41092 describes an improper access control in Microsoft Kinect that enables a locally authenticated attacker to elevate privileges. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.8 (HIGH). Affected component: Kinect functionality; root cause is insuffic...

CVE-2026-45639

The CVE-2026-45639 entry relates to an out-of-bounds read in Windows Remote Desktop Protocol (RDP). The underlying issue enables an unauthenticated, network-based attacker to disclose information over the network without user interaction. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:...

CVE-2026-50304

CVE-2026-50304 is a confirmed vulnerability affecting Microsoft Windows Active Directory Federation Services (AD FS). The issue is a stack-based buffer overflow in AD FS that could allow an unauthenticated network attacker to cause a denial of service. Connected sources corroborate the nature of ...

CVE-2026-50430

CVE-2026-50430 is the Windows Push Notifications information-disclosure vulnerability. The available sources state that exposure of sensitive information to an unauthorized actor can occur, allowing a locally-present attacker to disclose information. Affected component: Windows Push Notifications...

CVE-2026-58531

CVE-2026-58531 is a Windows SMB elevation-of-privilege vulnerability caused by a race condition in a shared resource. It affects Windows SMB components and enables an authorized attacker to elevate privileges over the network. CVSS v3.1 base score 7.5 (NETWORK, HIGH impact), per Microsoft’s advis...

CVE-2026-62747

CVE-2026-62747 is a heap-based buffer overflow in Windows Device Association Service that enables a locally authenticated attacker to elevate privileges. Exploit details are not provided in the connected documents, and no specific patch/version is listed here; CVSS v3.1 base score is 7.8 ( HIGH )...

CVE-2025-48803

CVE-2025-48803 affects Windows Virtualization-Based Security (VBS) Enclave. The root cause is a missing integrity check in the Enclave, enabling an authorized local attacker to obtain elevated privileges. The NCSC aggregation also lists CVE-2025-48803 with an impact of gaining elevated privileges...

CVE-2025-49708

CVE-2025-49708: A use-after-free vulnerability in the Microsoft Graphics Component can allow an authorized attacker to elevate privileges over the network. Connected Microsoft security updates and advisories indicate this issue is addressed in October 2025 Windows updates (KBs referenced in KB506...

CVE-2025-49753

Technical details for CVE-2025-49753 are not provided in the Connected documents; the Initial Description mentions a heap-based buffer overflow in RRAS but no vendor/product/version/impact details are given in the connected material.

CVE-2026-20936

CVE-2026-20936 is an information-disclosure vulnerability in Windows NDIS (network data path). The issue is an out-of-bounds read in the NDIS driver that could allow an authorized attacker with physical access to disclose data. In the Nessus/NCSC/NVD entries, the CVE is flagged under Windows NDIS...

CVE-2026-24294

CVE-2026-24294 affects Windows SMB Server. The core issue is improper authentication in the SMB component, enabling an authorized local attacker to elevate privileges. The CVE is rated high (CVSS 3.1 base 7.8) with local attack vector, low complexity, and no user interaction required, and the imp...

CVE-2026-24296

CVE-2026-24296 affects Windows Device Association Service, where concurrent execution on a shared resource with improper synchronization (race condition) enables a local, authorized attacker to elevate privileges. The issue is documented across multiple sources (NVD/NCSC/ENISA/CVEs listing) with ...

CVE-2026-32162

CVE-2026-32162 is a Windows COM elevation of privilege vulnerability with local access, no user interaction, and high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.4 (HIGH) with exploit code maturity labeled UNPROVEN and remediation level OFFICIAL_FIX. Affec...

CVE-2026-42971

CVE-2026-42971 involves a use of an uninitialized resource in Windows Push Notifications, enabling a locally authenticated attacker to disclose information. Affected component: Windows Push Notifications. Root cause: use of an uninitialized resource. Impact: local information disclosure with Conf...

CVE-2026-42979

CVE-2026-42979 describes a race condition in Windows Push Notifications due to improper synchronization on a shared resource, enabling a locally authenticated attacker to elevate privileges. The vulnerability is characterized by local access, high impact on confidentiality, integrity, and availab...

CVE-2026-45603

The vulnerability CVE-2026-45603 affects Windows’ Ancillary Function Driver for WinSock (AFD). The issue is a use-after-free in the WinSock-related driver, leading to local privilege escalation for an authorized attacker. The CVSS3.1 assessment shows HIGH impact with LOCAL access, HIGH confidenti...

CVE-2026-47648

CVE-2026-47648 — Windows Storage contains an untrusted search path vulnerability that enables a locally authenticated attacker to perform privilege escalation. The issue arises from a trusted component loading an untrusted search path, potentially elevating privileges with high impact (C/H/I/H/A/...

CVE-2026-50357

CVE-2026-50357 affects Windows Resilient File System (ReFS). The issue is a numeric truncation error in ReFS that, per the provided documents, can enable an authorized attacker to execute code locally. The MSRC/MSVCN details list this as an elevation of privileges / local arbitrary code execution...

CVE-2026-50415

CVE-2026-50415 affects Windows Media. The issue is exposure of sensitive information to an unauthorized actor over a network, enabling information disclosure. NVD and other sources describe a network-available impact with high confidentiality impact (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

CVE-2026-61365

CVE-2026-61365: Windows Remote Desktop Services contains a missing-authentication flaw in a critical function that allows local privilege escalation by an authorized user. CVSS 3.1 baseline is 7.8 (HIGH); attack vector LOCAL, requires LOW privileges, no user interaction, and results in HIGH impac...

CVE-2026-62700

CVE-2026-62700 describes a heap-based buffer overflow in Windows NTFS that allows an authenticated, local attacker to elevate privileges. The vulnerability affects the NTFS component on Windows and is rated CVSSv3.1#3.1 with a base score of 7.8 (HIGH) and local attack vector/low complexity, requi...

CVE-2025-29957

Technical details about CVE-2025-29957 (Windows Deployment Services) are not provided in the supplied documents. Please monitor for updated advisories from Microsoft or NVD for affected product/version, root cause, impact, and remediation.

CVE-2026-32074

CVE-2026-32074 concerns the Windows Projected File System (ProjFS) Elevation of Privilege. The vulnerability is local: attack vector Local, requires LOW privileges, with LOW attack complexity and no user interaction. It impacts confidentiality, integrity, and availability (all HIGH). The CVSS 3.1...

CVE-2026-32163

CVE-2026-32163 corresponds to a race condition in Windows User Interface Core that can allow an authorized local attacker to elevate privileges. The confluence of connected advisories confirms this CVE is tracked as affecting Windows UI Core, with a CVSS v3.1 score of 7.8 (LOCAL, HIGH impact on c...

CVE-2026-44799

This CVE (CVE-2026-44799) describes a heap-based buffer overflow in the Remote Desktop Client that allows an unauthorized attacker to execute code remotely over a network . The connected records corroborate a network-based, remote code execution vulnerability affecting the Remote Desktop Client, ...

CVE-2026-44805

CVE-2026-44805: Use-after-free in Windows Network Controller (NC) Host Agent enables an authorized local attacker to cause denial of service. Affected component is the Windows Network Controller Host Agent; underlying cause is use-after-free. CVSSv3.1 base score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I...

CVE-2026-50471

CVE-2026-50471 is a heap-based buffer overflow in Windows NTFS that could allow a local attacker to execute arbitrary code. The vulnerability affects Windows NTFS components as described in multiple sources (NVD/NCSC/CIRCL) and is being addressed by Microsoft with published updates (e.g., KB arti...

CVE-2026-50494

CVE-2026-50494 is a Windows NTFS vulnerability caused by a heap-based buffer overflow in NTFS handling that can let an authorized, local attacker execute code on the host. The issue affects Windows NTFS components and is being addressed by Microsoft security updates (e.g., KB5099539, KB5099540) r...

CVE-2026-50498

CVE-2026-50498 affects the Windows Universal Disk Format File System Driver (UDFS) and is an Elevation of Privilege vulnerability in the UDFS component. The root cause is described as a privilege/escalation condition within the Windows UDFS driver, leading to local privilege escalation with a hig...

CVE-2026-61921

This CVE describes an out-of-bounds read in Windows Remote Desktop Client that allows an unauthenticated attacker to disclose information over a network, impacting confidentiality (C:H) with CVSS 6.5 (Network, Low complexity, User interaction required). No exploitation details are provided in the...

CVE-2026-62887

CVE-2026-62887 is a local information-disclosure flaw in Windows NTFS due to an out-of-bounds read. The vulnerability allows an authenticated attacker with LOW privileges and LOCAL access to read sensitive data without user interaction. The CVSS v3.1 metrics indicate a MEDIUM base score (5.5), wi...

CVE-2026-65790

CVE-2026-65790 is a heap-based buffer overflow in Windows Message Queuing that enables an authorized, locally authenticated attacker to achieve elevation of privilege. Affected component: Windows Message Queuing; root cause: improper heap handling leading to a overflow condition. Impact: local pr...

CVE-2026-77493

CVE-2026-77493 is a double free flaw in the Microsoft Windows Graphics Component that allows an unauthorized, remote attacker to achieve code execution over the network with no privileges or user interaction. The CNA-assigned CVSS 3.1 score is 9.8 (CRITICAL) , with high impact to confidentiality,...

CVE-2025-47980

Technical details about CVE-2025-47980 (affected product/components, root cause, impact, fixes) are not provided in the connected documents. Monitor for updates as more information becomes public.

CVE-2025-49659

Technical details for CVE-2025-49659 are not present in the provided connected documents. Public information about affected products, root cause, exploit status, and fixes is not available here; monitor for updates from official advisories.

CVE-2025-49722

Technical details about CVE-2025-49722 are not present in the provided documents. No affected products, root cause, exploit vector, or fixes are disclosed here. Monitor for updates and consult the primary CVE entry for authoritative information.

CVE-2025-55229

CVE-2025-55229 concerns improper verification of cryptographic signatures in Windows Certificates, enabling a network attacker to spoof over the network. The primary root cause is flawed verification during certificate handling, with the CVSS data indicating network access, low attack complexity,...

CVE-2025-55231

CVE-2025-55231 describes a race condition in the Windows Storage-based Management Service where concurrent access to a shared resource is improperly synchronized, enabling a network-based attacker to potentially execute code. Affected component: Windows Storage-based Management Service (Windows S...

CVE-2026-25165

CVE-2026-25165 is a Windows local privilege escalation affecting Performance Counters. The description notes a local attack with low privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The underlying root cause and affected component details are not p...

CVE-2026-27928

CVE-2026-27928 is a Windows Hello security feature bypass vulnerability. The initial sources describe improper input validation in Windows Hello that allows an unauthenticated attacker to bypass a security feature over a network (attack vector: network; user interaction: none). The CVSS 3.1 base ...

CVE-2026-54125

CVE-2026-54125 affects Windows Runtime and describes a race-condition vulnerability in concurrent execution on a shared resource that enables local privilege elevation for an authenticated attacker. The CVE is rated with CVSSv3.1 base metrics: AV Local, AC Low, PR Low, UI None, S unchanged, C/H/I...

CVE-2026-56186

CVE-2026-56186 is a Windows Schannel vulnerability described as an out-of-bounds read that enables an authorized attacker to disclose information over a network. The CVE affects the Windows Schannel security component and is rated with CVSS v3.1 base score 8.1 (High) and NETWORK attack vector wit...

CVE-2026-61364

The CVE-2026-61364 entry concerns Windows Remote Desktop Services. A missing authentication flaw in a critical function enables a locally authenticated attacker with low privileges to elevate to higher privileges, as indicated by the CVSS 3.1 vector (L/L). Exploitation details or in-the-wild stat...