2841 matches found
CVE-2026-42986
CVE-2026-42986 describes a use-after-free in the Microsoft Graphics Component that allows an authorized attacker to elevate privileges locally. Affected: Microsoft Graphics Component; vulnerability class: use-after-free leading to local privilege escalation. Root cause as stated: after-free condi...
CVE-2026-45653
CVE-2026-45653: A Windows Kernel use-after-free vulnerability that enables local privilege escalation by an authorized attacker. The issue affects kernel code paths susceptible to use-after-free, with an attack vector that is LOCAL, requiring LOW privileges and NO user interaction; the impact per...
CVE-2026-48563
CVE-2026-48563 describes a heap-based buffer overflow in the Remote Desktop Client that enables an unauthenticated attacker to execute code over the network. The accompanying metrics indicate a high-severity impact (CVSS 3.1 base score 7.5) with attacker control over network access, requiring use...
CVE-2026-48575
CVE-2026-48575 describes a protection mechanism failure in Windows Secure Boot that allows an authorized, local attacker to bypass a security feature. The vulnerability enables a local escalation path with high impact on confidentiality and integrity (base score 7.9; AV:L/AC:L/PR:H/UI:N/S:C/C:H/I...
CVE-2026-49801
The CVE-2026-49801 entry concerns Windows SMB: an uninitialized resource within SMB handling can lead to local information disclosure by an authorized user. The attack is described as local with low privileges required and no user interaction, and the impact targets confidentiality (information d...
CVE-2026-50359
CVE-2026-50359 is a Microsoft XML Core Services elevation-of-privilege vulnerability described as a use-after-free issue. The NVD/NCSC/CIRCL entries confirm local privilege escalation for an authorized user. No exploit vectors are provided in the documents. Microsoft has released updates addressi...
CVE-2026-50463
CVE-2026-50463 is a Windows Kernel information-disclosure flaw (out-of-bounds read) that can be exploited remotely over a network to disclose data. The CVE is documented across NVD/EUVD and related feeds, and Microsoft has released updates (KB5099539/KB5099540 and MSRC page) addressing this vulne...
CVE-2026-50482
CVE-2026-50482 : Heap-based buffer overflow in Windows NTFS can allow a locally authenticated attacker to execute code. Exploitation requires local access with low privileges and user interaction, per the CVE metrics (AV:L, PR:L, UI:R). Public references indicate Microsoft has released updates to...
CVE-2026-50484
CVE-2026-50484 is a Windows Kernel heap-based buffer overflow that enables local privilege escalation for an authenticated attacker. Public docs confirm the vulnerability and affected component as the Windows Kernel, with the impact described as local privilege elevation. Microsoft and MSRC have ...
CVE-2026-50485
CVE-2026-50485 is a Windows Hyper-V Denial of Service vulnerability caused by a buffer over-read. It can be exploited by an attacker who has adjacent network access to deny service on the target host, with high privileges required and no user interaction. The documented impact is availability los...
CVE-2026-62703
CVE-2026-62703: Out-of-bounds read in Windows DWM Core Library. An authenticated, local attacker can disclose information. Affected component: Windows DWM Core Library. Impact aligns with CVSS: Confidentiality High; Privileges Required Low; User Interaction None; Attack Vector Local. The provided...
CVE-2026-62715
The CVE-2026-62715 entry describes an integer underflow (wrap or wraparound) in Windows DHCP Server that allows an unauthorized attacker on an adjacent network to disclose information. Affected component: Windows DHCP Server. Cause: underflow in a function handling DHCP data; impact: information ...
CVE-2026-62738
The vulnerability CVE-2026-62738 affects Windows Management Instrumentation and enables an authorized, local attacker to disclose information through an out-of-bounds read. The available descriptions consistently state information disclosure as the impact; no details on specific vulnerable binari...
CVE-2026-62812
CVE-2026-62812 concerns Windows DHCP Server and describes an elevation of privilege via improper link resolution before file access ('link following'). An attacker with local, low-privilege access and no user interaction could elevate privileges to achieve high impact (CVSS v3.1: AV:L/AC:L/PR:L/U...
CVE-2026-73025
CVE-2026-73025 is a Security Feature Bypass vulnerability in Windows iSCSI , rooted in weak authentication that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector, low complexity, n...
CVE-2025-49730
Technical details about CVE-2025-49730 are not publicly available in the provided connected documents. Monitor for updates from official advisories; no information on affected products, root cause, or fixes is provided here.
CVE-2025-53137
CVE-2025-53137 affects Windows' Ancillary Function Driver for WinSock. It is a use-after-free vulnerability that can lead to local privilege escalation when exploited by an authenticated attacker. The connected documents confirm the affected component and the high-severity impact (local, with ele...
CVE-2025-54913
CVE-2025-54913 affects Windows UI XAML Maps MapControlSettings. It is a race condition caused by concurrent execution using a shared resource with improper synchronization, allowing an authorized attacker to locally elevate privileges. Reported CVSS base score ~7.8 (HIGH) with LOCAL attack vector...
CVE-2025-58733
CVE-2025-58733 corresponds to a use-after-free in Inbox COM Objects on Windows that enables local code execution. Connected sources confirm Inbox COM Objects as the vulnerable component and describe the impact as arbitrary code execution by a local attacker. Public advisories from Microsoft and C...
CVE-2026-20864
CVE-2026-20864 describes a heap-based buffer overflow in the Connected Devices Platform Service (Cdpsvc) on Windows that enables an authorized local attacker to elevate privileges. The vulnerability affects Cdpsvc and is rated high (CVSS v3.1 base 7.8; Local, Low Attack Complexity, Privileges Req...
CVE-2026-20923
CVE-2026-20923 is a use-after-free in Windows Management Services that allows an authorized, locally situated attacker to elevate privileges. Evidence from Nessus/NVD/CVE records shows this CVE is associated with Windows Management Services and is listed among January 2026 security updates. Remed...
CVE-2026-26154
Technical details about CVE-2026-26154 are not publicly provided in the supplied documents. Monitor official advisories for updates on affected products, impact, and remediation.
CVE-2026-27908
CVE-2026-27908 is a Windows Elevation of Privilege vulnerability in the TDI Translation Driver (tdx.sys). The CVSS 3.1 base score is 7.0 (HIGH) with LOCAL attack vector, HIGH impact to confidentiality, integrity, and availability. Exploitation is deemed UNPROVEN and requires LOW privileges with N...
CVE-2026-27928
CVE-2026-27928 is a Windows Hello security feature bypass vulnerability. The initial sources describe improper input validation in Windows Hello that allows an unauthenticated attacker to bypass a security feature over a network (attack vector: network; user interaction: none). The CVSS 3.1 base ...
CVE-2026-32077
CVE-2026-32077 is a Windows UPnP Device Host elevation-of-privilege vulnerability. The CVSS v3.1 base score is 7.8 (HIGH) with a LOCAL attack vector, LOW attack complexity, and required LOW privileges; no user interaction is needed. Affects confidentiality, integrity, and availability (all HIGH i...
CVE-2026-32086
CVE-2026-32086 is an Elevation of Privilege vulnerability in Windows’ Function Discovery Service (fdwsd.dll). The entry notes local attack potential with a HIGH impact on confidentiality, integrity, and availability, requiring LOW privileges and no user interaction. The CVSS details indicate a HI...
CVE-2026-32209
Technical details (affected components, exploit vectors, root cause, vulnerable versions, and fixes) are not publicly provided in the supplied documents. Monitor official updates from NVD/CVE for further information.
CVE-2026-34338
CVE-2026-34338 : Use-after-free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. The publicly provided documents confirm the vulnerability and impact but do not reveal affected Windows versions, exact internal component, or remediation details. The NVD ent...
CVE-2026-35424
Technical details about CVE-2026-35424 (affected products, root cause, exploitability, and fixes) are not publicly provided in the supplied documents. Monitor for updates from official sources.
CVE-2026-41087
CVE-2026-41087 affects Windows File Explorer; a local attacker can cause exposure of sensitive information to obtain disclosure on the host. The vulnerability is rated CVSSv3.1: 5.5 (Medium) with Local access, Low attack complexity, Privileges Required: Low, no user interaction, and Confidentiali...
CVE-2026-42905
The CVE-2026-42905 entry describes a use-after-free vulnerability in the Windows DWM Core Library that allows an authorized attacker to escalate privileges locally. Affected component: Windows DWM Core Library. Root cause: use-after-free condition leading to local privilege escalation. Impact: el...
CVE-2026-50373
CVE-2026-50373 affects the Microsoft Windows Search Component (Windows Search Service). It enables local elevation of privileges via improper access control. Microsoft has released updates (e.g., KB5101650 and MSRC guidance) to address the vulnerability; apply the available security updates to mi...
CVE-2026-50412
CVE-2026-50412 is a Windows NTFS elevation-of-privilege vulnerability caused by a stack-based buffer overflow. The affected component is NTFS in Windows, allowing an authorized local attacker with low privileges and no user interaction to gain SYSTEM-level privileges (base CVSS v3.1: 7.8, Local, ...
CVE-2026-50432
CVE-2026-50432 describes a Use-after-free vulnerability in the Windows Virtual Filtering Platform (VFP) . An authenticated attacker could trigger a denial-of-service condition over the network by exploiting this flaw in the VFP code path, as indicated by the CVE entry: AV:N/AC:H/PR:L/UI:N/S:U/C:N...
CVE-2026-50469
CVE-2026-50469 affects Windows Projected File System. The flaw is an improper link resolution before file access (link following) that enables an authenticated local attacker to elevate privileges. Documented impact is privilege escalation with a CVSS 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score...
CVE-2026-54122
CVE-2026-54122 describes a heap-based buffer overflow in Windows GDI+ that enables local code execution by an unauthenticated attacker. The vulnerability affects the Windows GDI+ component and is rated high (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4). The available documents confirm the ...
CVE-2026-56175
CVE-2026-56175 describes a heap-based buffer overflow in Windows NTFS that allows an authorized, local attacker to elevate privileges. Connected sources (Microsoft MSRC update, NVD, NTFS/CIRCL sightings) confirm the vulnerability is in Windows NTFS, with local-privilege-escalation potential and a...
CVE-2026-61924
Technical details about CVE-2026-61924 are not publicly provided in the supplied documents; monitor official advisories from Microsoft and NVD for updates, affected products, and remediations.
CVE-2026-62711
The CVE-2026-62711 issue is a local privilege escalation caused by a use-after-free in Windows Win32K. Affected component: Win32K memory management; root cause: use-after-free vulnerability. Impact, if exploited: an authorized local attacker can elevate privileges. CVSS v3.1 score is 7.8 ( HIGH )...
CVE-2026-62773
CVE-2026-62773 describes a use-after-free vulnerability in Windows Kerberos that enables a locally authenticated attacker to elevate privileges. The flaw is triggered in the Kerberos subsystem and, when exploited, could allow elevation of rights with high impact on confidentiality, integrity, and...
CVE-2026-69694
CVE-2026-69694 affects the Windows IP Address Management (IPAM) Service . The root cause is deserialization of untrusted data , which allows an authorized attacker to escalate privileges locally. The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating tha...
CVE-2026-80096
CVE-2026-80096 is an out-of-bounds read vulnerability in Windows Remote Desktop Services that allows an authorized attacker to elevate privileges over a network. Microsoft rated it CVSS 3.1: 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw req...
CVE-2025-29832
Technical details about CVE-2025-29832 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are detailed here. Monitor for updates.
CVE-2025-47987
Technical details of CVE-2025-47987 (affected product, vulnerable component, impact, exploitability) are not provided in the supplied documents. Monitor for updates from Microsoft and CVE repositories.
CVE-2025-48815
CVE-2025-48815 affects Windows OS via a type confusion in the SSDP Service that could allow an authorized local attacker to elevate privileges. The description states local privilege escalation with high impact (CVSSv3.1: 7.8, HIGH). No explicit exploitation details or vendor/product versions are...
CVE-2025-49663
Technical details for CVE-2025-49663 are not provided in the connected documents; the initial description mentions RRAS heap overflow but lacks concrete product/version/impact details—monitor for updates.
CVE-2025-49686
Technical details for CVE-2025-49686 are not publicly provided in the supplied documents. No affected products, root cause, or remediation are confirmed here. Monitor for official updates from Microsoft and CVE references.
CVE-2025-49722
Technical details about CVE-2025-49722 are not present in the provided documents. No affected products, root cause, exploit vector, or fixes are disclosed here. Monitor for updates and consult the primary CVE entry for authoritative information.
CVE-2025-53796
CVE-2025-53796 — Windows RRAS buffer over-read that allows an unauthenticated, network-based disclosure of information. The initial description confirms a network disclosure risk via RRAS; connected documents reference Microsoft security guidance and a vulnerability entry but do not provide concr...