CVE-2026-70283

CVE-2026-70283 affects Windows Win32K , the kernel-mode component handling window management. The root cause is an incorrect authorization flaw that allows a local attacker with low privileges to achieve local privilege escalation , resulting in full compromise of confidentiality, integrity, and ...

CVE-2026-72944

CVE-2026-72944 is a heap-based buffer overflow in the Windows Fax Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability carries a CVSS 3.1 base score of 7.8 (High) , with a local attack vector, low complexity, low required privileges, and no user int...

CVE-2026-72947

CVE-2026-72947 is an integer underflow (wrap/wraparound) in the Windows File History Service that allows an authorized attacker to achieve local privilege escalation . Microsoft rates it 6.4 MEDIUM (CVSS 3.1, high privileges required), while NVD assigns 7.0 HIGH (low privileges required). CISA's ...

CVE-2026-73014

CVE-2026-73014 is a missing authorization flaw in the Data Sharing Service Client , a Microsoft component, that allows an attacker with local, low-privilege access to escalate privileges on the affected system. The vulnerability is rated CVSS 3.1 7.8 (High) with a local attack vector, low complex...

CVE-2026-73019

CVE-2026-73019 involves an improper resolution of path equivalence in the Windows URL Moniker component, allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability requires user interaction and grants low confidentiality impact with no integrity or availabili...

CVE-2026-78508

CVE-2026-78508 is an out-of-bounds read in the Windows CD-ROM Driver that allows an unauthorized attacker with physical access to disclose information. The CVSS 3.1 score is 4.6 (MEDIUM) , reflecting the physical attack vector, low complexity, no privileges required, and a high confidentiality im...

CVE-2026-83987

CVE-2026-83987 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with low attack complexity, low privileges required, no user interaction, and high impact on ...

CVE-2026-83989

CVE-2026-83989 is an out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver that allows an unauthenticated, remote attacker to cause a denial of service over a network. The vulnerability is rated CVSS 7.5 (HIGH) with a network attack vector, low complexity, no privileges or user int...

CVE-2025-60719

Technical details about CVE-2025-60719 are not provided in the connected documents. The initial description notes a local privilege elevation in Windows AFD/WinSock, but no vendor/version specifics or fixes are included here. Monitor official advisories for updates.

CVE-2026-20847

CVE-2026-20847 is described in connected sources as a Windows Shell vulnerability that allows spoofing of a user over a network. The NVD entry lists a MEDIUM severity (CVSS 3.1: 6.5) with network attack vector, low complexity, and requires low privileges; impact shown as high confidentiality loss...

CVE-2026-20848

CVE-2026-20848 describes a race condition in Windows SMB Server caused by concurrent execution over a shared resource with improper synchronization. This vulnerability could allow an authorized attacker to elevate privileges over the network. Connected documents confirm the issue is categorized a...

CVE-2026-20939

CVE-2026-20939: Windows File Explorer information disclosure allowing a locally authenticated user to view sensitive data. The issue has a CVSSv3.1 base score of 5.5 (Local, Low attack complexity, Low privileges, Confidentiality impact: High). Microsoft has released fixes in January 2026 security...

CVE-2026-32075

CVE-2026-32075 affects Windows that uses the UPnP Device Host; vulnerability is Elevation of Privilege via a local vector. Requires LOW privileges and no user interaction, with high impact on confidentiality, integrity, and availability. Exploit code maturity is UNPROVEN; remediation is an offici...

CVE-2026-69309

CVE-2026-69309 is a local privilege escalation vulnerability in Windows Print Spooler Components , caused by a double free defect. An attacker with low local privileges and high attack complexity can exploit it without user interaction to achieve full compromise of confidentiality, integrity, and...

CVE-2026-69331

CVE-2026-69331 is a use-after-free vulnerability in Windows Remote Access Connection Manager that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 3.1: 7.0) with a local attack vector , high complexity , and low privileges required . No user intera...

CVE-2026-69451

Windows Management Instrumentation (WMI) contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, meaning exploitation requires network access , low priv...

CVE-2026-69495

A heap-based buffer overflow in the Windows Event Logging Service allows an unauthorized attacker to achieve remote code execution over a network. The assigned CVSS 3.1 score is 8.8 (HIGH) , with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires user interactio...

CVE-2026-69538

CVE-2026-69538 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver. An attacker with low local privileges can exploit this to execute code on the target system, leading to high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8 – HIGH ). The attack v...

CVE-2026-69602

CVE-2026-69602 is a use after free vulnerability in the Windows PrintWorkflowUserSvc component that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 base score is 7.1 (HIGH) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating a network-based attack with hig...

CVE-2026-69631

CVE-2026-69631 is an integer overflow or wraparound vulnerability in Windows DNS that allows an unauthenticated remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-based attack with...

CVE-2026-69681

CVE-2026-69681 is a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low privi...

CVE-2026-70565

CVE-2026-70565 is a use-after-free vulnerability in the Windows AF_UNIX Socket Provider that allows an authorized attacker to perform local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexit...

CVE-2026-70570

CVE-2026-70570 is a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) . An attacker on an adjacent network can exploit it with no privileges and no user interaction , though exploitation requires high complexity . Successful exploitation grants the attacker f...

CVE-2026-78450

CVE-2026-78450 is a use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) that allows an unauthorized, network-based attacker to achieve remote code execution . The vulnerability was reported by Microsoft (CNA source) and assigned a CVSS 3.1 base score of 8.1 (H...

CVE-2026-83977

CVE-2026-83977 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized, low-privilege local attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires n...

CVE-2025-60706

According to the NCSC advisory, CVE-2025-60706 is a vulnerability in Windows Hyper-V where an out-of-bounds read can allow an authorized local attacker to disclose information (impact: access to sensitive data). The CVE is listed under Windows Hyper-V in the advisory with a CVSS v3.1 base score o...

CVE-2025-60714

Technical details for CVE-2025-60714 are not provided in the supplied documents. Connected KB/MS update entries discuss Windows Secure Boot and general OS updates but do not disclose affected products, root cause, or fixes for this CVE. Monitor for updates.

CVE-2025-62454

CVE-2025-62454 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that could allow an authorized local attacker to achieve elevated privileges. Connected notes confirm this CVE is mapped to the Windows Cloud Files Mini Filter Driver elevation of privilege vulnerability ...

CVE-2026-20874

CVE-2026-20874 is a Windows Management Services race condition that can lead to local privilege elevation. The initial description states the issue is a race condition in Windows Management Services exploited by an authorized attacker to escalate privileges. Connected documents corroborate this u...

CVE-2026-27909

CVE-2026-27909 is a Windows Search Component elevation-of-privilege vulnerability (use-after-free) that could allow an authenticated local attacker to gain SYSTEM privileges. Connected advisories confirm the issue and indicate Microsoft has fixed vulnerabilities across Windows components in April...

CVE-2026-49165

The CVE-2026-49165 entry concerns the Microsoft Windows App Store. The connected sources confirm that the vulnerability arises from use of an uninitialized resource, enabling an authorized local attacker to disclose information. Impact is information disclosure with local access; CVSS 3.1 factors...

CVE-2026-49793

CVE-2026-49793 is a heap-based buffer overflow in the Windows Resilient File System (ReFS) that could allow an authorized local attacker to execute code. Affected component: ReFS mechanisms handling memory allocations during I/O; root cause described as a heap-based overflow, enabling code execut...

CVE-2026-49799

Technical details are not publicly available in the provided documents. No confirmed affected products, fixes, or exploit specifics are described here; monitor official sources for updates.

CVE-2026-57085

CVE-2026-57085 is a Windows Print Spooler vulnerability described as an out-of-bounds read in Print Spooler Components that allows an authorized, local attacker to disclose information. Connected sources confirm the affected component and local disclosure impact, with Microsoft and CVE trackers n...

CVE-2026-62759

Windows Netlogon is affected by an authentication bypass by spoofing vulnerability (CVE-2026-62759). An unauthorized attacker on an adjacent network can perform spoofing, potentially leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.5 (HIGH) with an a...

CVE-2026-68884

A heap-based buffer overflow in the Windows Kernel allows an authorized (low-privilege) local attacker to elevate privileges , per Microsoft's advisory (CVE-2026-68884). The vulnerability carries a CVSS v3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploit...

CVE-2026-68894

CVE-2026-68894 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker to elevate privileges over a network . The vulnerability is rated CVSS 8.0 (High) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , meaning it requires low privileges and user interact...

CVE-2026-68898

Windows iSCSI is vulnerable to an out-of-bounds read that allows an unauthorized, remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 6.5 (Medium) , with the attack requiring user interaction (e.g., opening a crafted file) but no prior privileges. CISA's SSVC assess...

CVE-2026-69281

CVE-2026-69281 is a use-after-free vulnerability in the Windows License Manager component that allows an authorized local attacker to elevate privileges. The vulnerability is rated CVSS 7.0 (High) with a vector of local attack, high complexity, low privileges required, no user interaction, unchan...

CVE-2026-69297

CVE-2026-69297 affects Windows DHCP Server , where passwords are stored in a recoverable format, allowing an authorized attacker (with low privileges) to disclose information over a network. The CVSS v3.1 score is 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability impa...

CVE-2026-69321

CVE-2026-69321 affects Windows Power Dependency Coordinator , a Windows system component. The root cause is missing authentication for a critical function, which allows a locally authenticated attacker with low privileges to perform tampering (integrity impact). The CVSS 3.1 score is 5.5 (Medium)...

CVE-2026-69353

CVE-2026-69353 is an out-of-bounds read vulnerability in Windows Text Shaping that allows a locally authenticated attacker with low privileges to disclose information. The attack vector is local, requires no user interaction, and the scope is unchanged. The CVSS v3.1 base score is 5.5 (Medium) , ...

CVE-2026-69371

A heap-based buffer overflow in Windows Overlay Filter allows an authorized, low-privileged attacker to elevate privileges over a network , with user interaction required and high impact to confidentiality, integrity, and availability (CVSS 8.0 HIGH ). CISA's SSVC assessment indicates no known ex...

CVE-2026-69428

Windows LDAP (Lightweight Directory Access Protocol) is vulnerable to an out-of-bounds read that allows an unauthorized, network-based attacker to cause a denial of service , with a CVSS 3.1 base score of 7.5 (HIGH) . The vulnerability requires no privileges and no user interaction, though it imp...

CVE-2026-69433

A heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to achieve local privilege escalation . The vulnerability is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, yielding high impact on confidentiality, integrity...

CVE-2026-69453

CVE-2026-69453 is a missing authorization vulnerability in the Microsoft Windows Search Component that allows an authenticated, low-privilege local attacker to perform tampering (integrity impact). The CVSS 3.1 base score is 5.5 (Medium) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indica...

CVE-2026-69573

CVE-2026-69573 is a use-after-free vulnerability in the Windows Universal Disk Format File System Driver (UDFS) . An authorized local attacker can exploit it to achieve privilege escalation , potentially gaining full control over confidentiality, integrity, and availability (CVSS 3.1 score 7.0 HI...

CVE-2026-69600

CVE-2026-69600 is a use after free vulnerability in the Microsoft Windows Search Component that allows an authorized attacker to perform local privilege escalation . The vulnerability requires low privileges, high attack complexity, and no user interaction, with high impact to confidentiality, in...

CVE-2026-69620

CVE-2026-69620 is a stack-based buffer overflow in Windows DHCP Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-based exploitation with high compl...

CVE-2026-69689

An out-of-bounds read in the Windows Win32K component allows an authorized attacker to elevate privileges over a network . The CVSS v3.1 score is 8.0 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , indicating a network-based attack requiring low privileges and user interaction, with high...