CVE-2026-62746

CVE-2026-62746 is a Windows Win32k information-disclosure vulnerability described as a buffer over-read that allows an authorized, local attacker to disclose information. Affected component: Win32k (Windows). Impact per provided metrics: confidentiality impact High; attack vector Local; attack co...

CVE-2026-62754

CVE-2026-62754 describes a heap-based buffer overflow in Windows Kerberos that allows an authorized attacker to achieve local privilege escalation. The flaw is triggered within the Kerberos-related code path, enabling elevation of privileges on the affected system. The available documents confirm...

CVE-2026-62758

CVE-2026-62758 is a heap-based buffer overflow in Windows Remote Access Connection Manager that permits a locally authenticated attacker to elevate privileges. Affected component: RASMAN service on Windows. Root cause: heap overflow enabling arbitrary code execution with HIGH impact on confidenti...

CVE-2026-62814

The CVE-2026-62814 entry pertains to an Integer underflow (wrap/wraparound) in Windows DHCP Server that allows an unauthorized attacker on an adjacent network to disclose information. The issue is described as an information disclosure vulnerability with an Adjacent attack vector and LOW attack c...

CVE-2025-47998

Technical details about CVE-2025-47998 are not provided in the supplied connected documents; the initial description notes a heap-based overflow in RRAS but no additional product/version/impact details are given here. Monitor for updates.

CVE-2025-53137

CVE-2025-53137 affects Windows' Ancillary Function Driver for WinSock. It is a use-after-free vulnerability that can lead to local privilege escalation when exploited by an authenticated attacker. The connected documents confirm the affected component and the high-severity impact (local, with ele...

CVE-2025-58726

CVE-2025-58726 affects Windows SMB Server with improper access control that enables an authenticated network attacker to elevate privileges. The issue is network-exploitable, requires low privileges, and has high impact on confidentiality, integrity, and availability. Microsoft and OS security up...

CVE-2026-20926

CVE-2026-20926 describes a race condition in the Windows SMB Server that allows an authorized network attacker to elevate privileges. The vulnerability affects Windows SMB Server components and is tied to concurrent execution on a shared resource with improper synchronization. Mitigation is via M...

CVE-2026-20936

CVE-2026-20936 is an information-disclosure vulnerability in Windows NDIS (network data path). The issue is an out-of-bounds read in the NDIS driver that could allow an authorized attacker with physical access to disclose data. In the Nessus/NCSC/NVD entries, the CVE is flagged under Windows NDIS...

CVE-2026-21247

CVE-2026-21247 is an input-validation flaw in Windows Hyper-V that can allow a locally authenticated attacker to execute arbitrary code. The vulnerability arises from improper handling of input, with a CVSSv3.1 base score of 7.3 (HIGH), indicating local attack vector, low attack complexity, and r...

CVE-2026-21249

Technical details about CVE-2026-21249 are not provided in the supplied documents. Monitor for updates from official advisories for affected products, impact, and remediation.

CVE-2026-25165

CVE-2026-25165 is a Windows local privilege escalation affecting Performance Counters. The description notes a local attack with low privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The underlying root cause and affected component details are not p...

CVE-2026-26180

CVE-2026-26180 is a Windows kernel local elevation of privilege issue. The vulnerability affects the Windows kernel with a local attacker able to gain HIGH impact on confidentiality, integrity, and availability. Exploitation is LOCAL with LOW complexity and LOW privileges required, and no user in...

CVE-2026-27928

CVE-2026-27928 is a Windows Hello security feature bypass vulnerability. The initial sources describe improper input validation in Windows Hello that allows an unauthenticated attacker to bypass a security feature over a network (attack vector: network; user interaction: none). The CVSS 3.1 base ...

CVE-2026-44801

CVE-2026-44801 = heap-based buffer overflow in Remote Desktop Client enabling a remote code execution by an unauthenticated attacker over the network. Root cause: heap overflow; impact: remote execution of code. Affected software/version details are not provided in the documents. No exploit statu...

CVE-2026-45639

The CVE-2026-45639 entry relates to an out-of-bounds read in Windows Remote Desktop Protocol (RDP). The underlying issue enables an unauthenticated, network-based attacker to disclose information over the network without user interaction. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:...

CVE-2026-50330

CVE-2026-50330 is a Windows Remote Desktop Client vulnerability described as a heap-based buffer overflow that allows an unauthenticated attacker to escalate privileges over the network. The CVE appears in multiple sources (NVD, EUVD, CIRCL) with consistent language about privilege elevation via ...

CVE-2026-50365

CVE-2026-50365 describes an Elevation of Privileges in the Windows RPC API (RPC server) due to improper authentication, enabling an adjacent-network attacker to gain high-priority access. Public data confirms an adjacent-network attack vector with high severity (CVSS ~8.0). The affected component...

CVE-2026-50509

CVE-2026-50509 is a Windows WWAN Service deserialization vulnerability that could enable local privilege escalation when an authorized user triggers the flaw. Affected component: Windows Wireless Wide Area Network Service (WwanSvc). Root cause: deserialization of untrusted data leading to elevati...

CVE-2026-61925

CVE-2026-61925 describes an elevation of privilege vulnerability in Windows Installer caused by incorrect authorization checks. An authenticated local attacker can exploit this to gain higher privileges on the host. CVSS v3.1 metrics indicate a HIGH-severity, local attacker, no user interaction, ...

CVE-2026-61936

CVE-2026-61936 describes a local security bypass in the Windows Defender Firewall Service where missing authorization allows an authorized attacker to bypass a security feature locally. The NVD entry and CVE records corroborate this description. According to the provided metrics, the impact is hi...

CVE-2025-47972

CVE-2025-47972 affects the Microsoft Input Method Editor (IME) in Windows. Connected records reflect a high-severity, privilege-escalation risk with CVSS v3.1 base score 8.0 (attack vector: network; impact: confidentiality, integrity, and availability high; privileges required: low; user interact...

CVE-2025-47976

Technical details beyond the high-level description are not provided in the supplied documents. No affected product versions, exploit details, or remediation are stated here. Monitor for updates from official advisories.

CVE-2025-47982

CVE-2025-47982 affects Windows Storage VSP Driver. The root cause is improper input validation, enabling a locally authenticated attacker to elevate privileges. CVSS v3.1 base score 7.8 (HIGH) with local, low-complexity, no user interaction required; impact includes high confidentiality, integrit...

CVE-2026-32086

CVE-2026-32086 is an Elevation of Privilege vulnerability in Windows’ Function Discovery Service (fdwsd.dll). The entry notes local attack potential with a HIGH impact on confidentiality, integrity, and availability, requiring LOW privileges and no user interaction. The CVSS details indicate a HI...

CVE-2026-40400

CVE-2026-40400 is a Windows PowerShell relative path traversal vulnerability that could enable an authorized attacker to execute code over a network. The CVE entry identifies a remote code execution risk with NETWORK attack vector, LOW attack complexity, and LOW privileges required, but with UI i...

CVE-2026-40409

Technical details for CVE-2026-40409 are not publicly available in the provided documents. Monitor for updates from Microsoft/NVD for affected products, root cause, impact, and remediation.

CVE-2026-41092

CVE-2026-41092 describes an improper access control in Microsoft Kinect that enables a locally authenticated attacker to elevate privileges. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.8 (HIGH). Affected component: Kinect functionality; root cause is insuffic...

CVE-2026-41095

This CVE is a local privilege escalation caused by a use-after-free in Windows Data Deduplication. The description identifies a vulnerability that an authorized attacker could exploit locally to gain higher privileges. The connected sources document the flaw in the Data Deduplication component an...

CVE-2026-42916

The CVE-2026-42916 entry describes an Integer underflow in the Windows NT OS Kernel that enables local privilege escalation for an authorized attacker. Affected: Windows NT OS Kernel (kernel-level component). Root cause: wrap/underflow during arithmetic in the kernel. Impact: high across confiden...

CVE-2026-45634

The CVE describes an out-of-bounds read in the Windows DHCP Server that enables an authorized local attacker to disclose information. The affected component is Windows DHCP Server; the root cause is a memory read violation leading to information disclosure. The CVSS metrics indicate a local attac...

CVE-2026-49788

CVE-2026-49788 : An HTTP/2 denial-of-service vulnerability due to unbounded resource allocation allows an unauthenticated network attacker to exhaust resources and disrupt service. CVSSv3.1 base score 7.5 (HIGH); vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No product/vendor/version details are p...

CVE-2026-50332

CVE-2026-50332 is a Windows Kernel elevation-of-privilege vulnerability described as a heap-based buffer overflow that can be exploited locally by an authorized user. Public sources in the connected documents confirm the issue affects Windows Kernel and note the CVE’s inclusion among July 2026 pa...

CVE-2026-50405

CVE-2026-50405 affects the Windows Filtering Platform (WFP). The issue is described as insufficient granularity of access control, enabling an authorized local attacker to elevate privileges. Connected sources (NVD, EUVD, CIRCL) corroborate the local privilege escalation impact and link to Micros...

CVE-2026-50430

CVE-2026-50430 is the Windows Push Notifications information-disclosure vulnerability. The available sources state that exposure of sensitive information to an unauthorized actor can occur, allowing a locally-present attacker to disclose information. Affected component: Windows Push Notifications...

CVE-2026-57090

CVE-2026-57090 is a remote code execution vulnerability in Windows Media Foundation due to a heap-based buffer overflow. The flaw allows an unauthenticated attacker to run arbitrary code over the network. Public sources in the connected documents corroborate an RCE impact for Windows Media Founda...

CVE-2026-58531

CVE-2026-58531 is a Windows SMB elevation-of-privilege vulnerability caused by a race condition in a shared resource. It affects Windows SMB components and enables an authorized attacker to elevate privileges over the network. CVSS v3.1 base score 7.5 (NETWORK, HIGH impact), per Microsoft’s advis...

CVE-2026-62700

CVE-2026-62700 describes a heap-based buffer overflow in Windows NTFS that allows an authenticated, local attacker to elevate privileges. The vulnerability affects the NTFS component on Windows and is rated CVSSv3.1#3.1 with a base score of 7.8 (HIGH) and local attack vector/low complexity, requi...

CVE-2026-62717

Summary: CVE-2026-62717 is a heap-based buffer overflow in Windows Message Queuing that could allow an authorized local attacker to elevate privileges. This is supported by multiple sources (NVD entry and CVE records). Affected component: Windows Message Queuing. Vulnerability type & root cause: ...

CVE-2026-70307

CVE-2026-70307 describes a use-after-free flaw in the Windows Ancillary Function Driver for WinSock that can allow an authorized local attacker to elevate privileges. Affected component is the Windows network stack’s Ancillary Function Driver used by WinSock; root cause is a use-after-free bug in...

CVE-2025-47999

CVE-2025-47999 : In Windows Hyper-V, missing synchronization allows an authorized attacker to cause a Denial-of-Service over an adjacent network. The CVSS v3.1 base score is 6.8 (AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Connected documents confirm Hyper-V is affected and describe DoS potential; expl...

CVE-2025-48001

Technical details about CVE-2025-48001 are not publicly provided in the supplied documents. No affected products, root cause, impact, or remediation specifics are present. Monitor for updates from vendors and security advisories.

CVE-2025-48811

CVE-2025-48811 affects Windows Virtualization-Based Security (VBS) Enclave, with the root cause described as missing integrity check in the Enclave. The NCSC advisory lists this CVE as impacting Windows VBS Enclave and notes an ability to obtain increased privileges. The entry indicates that Micr...

CVE-2025-48816

Technical details for CVE-2025-48816 (affected components, exploitability, and specific impact) are not provided in the connected documents. Monitor for updates; no public disclosure details are included in the supplied materials.

CVE-2025-49684

Technical details about CVE-2025-49684 (affected product, version, root cause, exploitability) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2025-49727

CVE-2025-49727 is described as a heap-based buffer overflow in Windows Win32K GRFX that could allow an authorized attacker to elevate privileges locally. The provided initial description confirms the vulnerability class and impact (local privilege escalation) but does not include concrete informa...

CVE-2025-49729

Technical details about CVE-2025-49729 are not provided in the connected documents. The initial description notes a heap-based buffer overflow in RRAS that could enable remote code execution, but no affected product/version specifics or mitigations are included.

CVE-2025-53720

Technical details about CVE-2025-53720 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories; current entries reference RRAS vulnerability but lack affected versions, exploit information, or mitigations in these sources.

CVE-2025-53789

CVE-2025-53789 affects Windows StateRepository API where missing authentication enables local privilege escalation. The NCSC advisory references this CVE with CVSS 3.1/7.8 (High) and impact described as escalating privileges. No explicit affected product/version details or fix/remediation are pro...

CVE-2025-54110

CVE-2025-54110 concerns a Windows Kernel integer overflow in NtQueryDirectoryObject that could enable local privilege escalation. Connected PoCs describe a kernel-EoP flow via crafted inputs, thresholds (e.g., 0xFFFFFDBC) and direct memory handling, but reports assert exploitation yields only STA...