CVE-2026-42905

The CVE-2026-42905 entry describes a use-after-free vulnerability in the Windows DWM Core Library that allows an authorized attacker to escalate privileges locally. Affected component: Windows DWM Core Library. Root cause: use-after-free condition leading to local privilege escalation. Impact: el...

CVE-2026-44801

CVE-2026-44801 = heap-based buffer overflow in Remote Desktop Client enabling a remote code execution by an unauthenticated attacker over the network. Root cause: heap overflow; impact: remote execution of code. Affected software/version details are not provided in the documents. No exploit statu...

CVE-2026-44810

CVE-2026-44810: Improper authentication in Windows Cryptographic Services allows a local attacker to elevate privileges. Affected: Windows Cryptographic Services. Impact: HIGH (CVSS 3.1 base 8.4) with local attack, no user interaction required; confidentiality, integrity, and availability are HIG...

CVE-2026-45608

CVE-2026-45608: Out-of-bounds read in Windows DHCP Server enables an authorized, local attacker to disclose information. Documents confirm the affected component as Windows DHCP Server and a local attack vector with low complexity and no privileges required (CVSSv3.1: AV:L/AC:L/PR:N/UI:N/S:U). Ba...

CVE-2026-48563

CVE-2026-48563 describes a heap-based buffer overflow in the Remote Desktop Client that enables an unauthenticated attacker to execute code over the network. The accompanying metrics indicate a high-severity impact (CVSS 3.1 base score 7.5) with attacker control over network access, requiring use...

CVE-2026-50304

CVE-2026-50304 is a confirmed vulnerability affecting Microsoft Windows Active Directory Federation Services (AD FS). The issue is a stack-based buffer overflow in AD FS that could allow an unauthenticated network attacker to cause a denial of service. Connected sources corroborate the nature of ...

CVE-2026-50427

CVE-2026-50427 affects Content Delivery Manager. Description: use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVSS v3.1: 7.8 (Local, Low user interaction, Privilege Escalation, high impact on confidentiality, integrity, availability). Connected sourc...

CVE-2026-50498

CVE-2026-50498 affects the Windows Universal Disk Format File System Driver (UDFS) and is an Elevation of Privilege vulnerability in the UDFS component. The root cause is described as a privilege/escalation condition within the Windows UDFS driver, leading to local privilege escalation with a hig...

CVE-2026-50688

CVE-2026-50688 is a Windows Win32k elevation-of-privilege vulnerability described as a use-after-free in the Win32k subsystem that allows a locally authenticated attacker to gain higher privileges. The connected documents confirm the CVE title and its Windows kernel context, with advisories and C...

CVE-2026-62715

The CVE-2026-62715 entry describes an integer underflow (wrap or wraparound) in Windows DHCP Server that allows an unauthorized attacker on an adjacent network to disclose information. Affected component: Windows DHCP Server. Cause: underflow in a function handling DHCP data; impact: information ...

CVE-2026-62747

CVE-2026-62747 is a heap-based buffer overflow in Windows Device Association Service that enables a locally authenticated attacker to elevate privileges. Exploit details are not provided in the connected documents, and no specific patch/version is listed here; CVSS v3.1 base score is 7.8 ( HIGH )...

CVE-2026-62887

CVE-2026-62887 is a local information-disclosure flaw in Windows NTFS due to an out-of-bounds read. The vulnerability allows an authenticated attacker with LOW privileges and LOCAL access to read sensitive data without user interaction. The CVSS v3.1 metrics indicate a MEDIUM base score (5.5), wi...

CVE-2026-65798

CVE-2026-65798 corresponds to a numeric truncation error in Windows DNS that enables an authorized attacker to perform local privilege escalation. Affected component: Windows DNS. Root cause: numeric truncation in DNS handling leading to elevated privileges. Impact is described as local elevation...

CVE-2025-47159

CVE-2025-47159 affects Windows Virtualization-Based Security (VBS) Enclave. The vulnerability is a protection mechanism failure that could allow an authorized local attacker to escalate privileges. Affected component: VBS Enclave in Windows. Outcome: local privilege escalation with HIGH impact if...

CVE-2025-47976

Technical details beyond the high-level description are not provided in the supplied documents. No affected product versions, exploit details, or remediation are stated here. Monitor for updates from official advisories.

CVE-2025-47996

Technical details about CVE-2025-47996 are not publicly provided in the supplied documents. No affected products, root cause, or remediation details are stated here. Monitor this CVE entry for updates.

CVE-2025-48809

CVE-2025-48809 corresponds to a Windows Secure Kernel Mode information disclosure vulnerability in the Windows kernel. Publicly cited description states that a processor optimization removal or modification of security-critical code in the Windows Kernel can allow an authorized local attacker to ...

CVE-2025-49684

Technical details about CVE-2025-49684 (affected product, version, root cause, exploitability) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2025-49727

CVE-2025-49727 is described as a heap-based buffer overflow in Windows Win32K GRFX that could allow an authorized attacker to elevate privileges locally. The provided initial description confirms the vulnerability class and impact (local privilege escalation) but does not include concrete informa...

CVE-2025-55326

CVE-2025-55326 is a Windows Cdpsvc (Connected Devices Platform Service) use-after-free vulnerability enabling remote code execution over a network. The provided connected documents confirm the issue, its network vector and a high risk (CVSS 3.1: 7.5, network attack, no privileges). Remediation in...

CVE-2025-55340

CVE-2025-55340 is a Windows Remote Desktop Protocol security feature bypass caused by improper authentication that can enable an authenticated local attacker to bypass a security feature. The vulnerability affects Windows Remote Desktop Protocol and is rated HIGH with a CVSSv3.1 vector of AV:L/AC...

CVE-2025-58718

CVE-2025-58718 is a use-after-free in the Windows Remote Desktop Client that allows a network-based, unauthenticated attacker to execute code on the affected system. CVSSv3.1 shows AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H with a base score of 8.8 (HIGH); exploitation requires user interaction. Connect...

CVE-2026-20822

CVE-2026-20822 is a Microsoft Windows graphics subsystem elevation-of-privilege vulnerability in the Microsoft Graphics Component caused by a use-after-free condition. It enables a locally authenticated attacker to elevate privileges on the host. The CVSS vector (Local, High complexity, Low privi...

CVE-2026-21231

CVE-2026-21231 describes a race condition in the Windows Kernel involving concurrent execution on a shared resource with improper synchronization, enabling local privilege escalation for an authorized attacker. The vulnerability impact is: local attack vector, requiring low privileges, no user in...

CVE-2026-21247

CVE-2026-21247 is an input-validation flaw in Windows Hyper-V that can allow a locally authenticated attacker to execute arbitrary code. The vulnerability arises from improper handling of input, with a CVSSv3.1 base score of 7.3 (HIGH), indicating local attack vector, low attack complexity, and r...

CVE-2026-21249

Technical details about CVE-2026-21249 are not provided in the supplied documents. Monitor for updates from official advisories for affected products, impact, and remediation.

CVE-2026-25173

CVE-2026-25173 concerns Windows RRAS where a module/component used by RRAS may be exploited to achieve remote code execution. The CVE is categorized with CVSS v3.1: base score 8.0 (HIGH), attack Vector: Network, attack Complexity: Low, privileges Required: Low, user Interaction: Required, and imp...

CVE-2026-32072

CVE-2026-32072 corresponds to an unauthenticated spoofing vulnerability in Windows Active Directory (local access). The Red Hat and NCSC entries corroborate the flaw as an AD authentication issue with local spoofing potential. Public documentation lists this CVE under Windows Active Directory wit...

CVE-2026-32156

CVE-2026-32156 is a use-after-free vulnerability in the Windows Universal Plug and Play (UPnP) Device Host (upnp.dll) that allows a local, unauthorized attacker to execute code on the system. The connected sources confirm the issue affects Windows UPnP Device Host and list it among UPnP-related C...

CVE-2026-33096

CVE-2026-33096 is an out-of-bounds read vulnerability in Windows HTTP.sys that can cause Denial-of-Service over the network. Public references confirm the issue and note that Microsoft has fixed the vulnerability in April 2026 security updates. Affected software is Windows (HTTP.sys component); t...

CVE-2026-42916

The CVE-2026-42916 entry describes an Integer underflow in the Windows NT OS Kernel that enables local privilege escalation for an authorized attacker. Affected: Windows NT OS Kernel (kernel-level component). Root cause: wrap/underflow during arithmetic in the kernel. Impact: high across confiden...

CVE-2026-48568

CVE-2026-48568 concerns a protection mechanism failure in Windows Secure Boot that allows a local attacker to bypass a security feature. The connected sources indicate an in-scope vulnerability where an attacker with HIGH privileges and local access can bypass integrity and confidentiality protec...

CVE-2026-48573

CVE-2026-48573 describes a protection mechanism failure in Windows Secure Boot allowing an authorized attacker to bypass a security feature locally. The NVD entry notes a local attack vector with high impact on confidentiality and integrity (C:H/I:H) and a CVSS v3.1 base score of 7.9. Connected d...

CVE-2026-50372

CVE-2026-50372 — Windows Redirected Drive Buffering : A buffer over-read vulnerability in Windows Redirected Drive Buffering could allow an authorized, local attacker to elevate privileges. The CVE is corroborated by multiple sources (NVD, MSRC, EUVD/ENISA, CIRCL sighting) with an incident descri...

CVE-2026-54111

CVE-2026-54111 affects Windows systems via the USB Print Driver. The underlying issue is a race condition caused by improper synchronization on a shared resource, enabling a locally authenticated attacker to elevate privileges. The CVSS v3.1 vector is LOCAL/ HIGH complexity, with LOW privileges r...

CVE-2026-54125

CVE-2026-54125 affects Windows Runtime and describes a race-condition vulnerability in concurrent execution on a shared resource that enables local privilege elevation for an authenticated attacker. The CVE is rated with CVSSv3.1 base metrics: AV Local, AC Low, PR Low, UI None, S unchanged, C/H/I...

CVE-2026-58619

CVE-2026-58619 is a Windows Sensor Data Service vulnerability described as a use-after-free that enables an authorized attacker to locally elevate privileges. The vulnerability is reported with CVSS 3.1: LOCAL attack vector, HIGH impact (C, I, A), and low privileges required with no user interact...

CVE-2026-61365

CVE-2026-61365: Windows Remote Desktop Services contains a missing-authentication flaw in a critical function that allows local privilege escalation by an authorized user. CVSS 3.1 baseline is 7.8 (HIGH); attack vector LOCAL, requires LOW privileges, no user interaction, and results in HIGH impac...

CVE-2026-62702

CVE-2026-62702 is a denial-of-service vulnerability in the Windows Graphics Kernel caused by a null pointer dereference that can be triggered over a network. Per NVD, CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (base 8.6, HIGH) with impact on availability. Microsoft MSRC lists this vulnerabili...

CVE-2026-62716

CVE-2026-62716 involves an integer underflow in Windows DHCP Server that permits information disclosure to an adjacent network. The affected component is Windows DHCP Server; the root cause is a wrap/wraparound error enabling data disclosure, with attack vector described as adjacent network acces...

CVE-2025-47998

Technical details about CVE-2025-47998 are not provided in the supplied connected documents; the initial description notes a heap-based overflow in RRAS but no additional product/version/impact details are given here. Monitor for updates.

CVE-2025-48001

Technical details about CVE-2025-48001 are not publicly provided in the supplied documents. No affected products, root cause, impact, or remediation specifics are present. Monitor for updates from vendors and security advisories.

CVE-2025-48816

Technical details for CVE-2025-48816 (affected components, exploitability, and specific impact) are not provided in the connected documents. Monitor for updates; no public disclosure details are included in the supplied materials.

CVE-2025-49729

Technical details about CVE-2025-49729 are not provided in the connected documents. The initial description notes a heap-based buffer overflow in RRAS that could enable remote code execution, but no affected product/version specifics or mitigations are included.

CVE-2025-53136

CVE-2025-53136 is listed under Windows NT OS Kernel with a Medium CVSS v3.1 (5.5) and impact described as Access to sensitive data . The connected documents provide the affected product (Windows NT OS Kernel) and impact, but do not disclose root cause details or a specific fix. Public references ...

CVE-2025-53720

Technical details about CVE-2025-53720 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories; current entries reference RRAS vulnerability but lack affected versions, exploit information, or mitigations in these sources.

CVE-2025-59185

CVE-2025-59185 affects Windows Core Shell, enabling spoofing via external control of a file name or path over a network. The connected documents provide general Windows security updates but do not specify a patch or remediation tied to this CVE; no explicit exploitation details are given in the s...

CVE-2026-20816

CVE-2026-20816 is a Windows Installer time-of-check/time-of-use (TOCTOU) race condition that can allow a local user with low privileges to escalate to higher privileges. The connected Nessus entries flag this as affecting Windows Installer and describe the vulnerability as a local privilege escal...

CVE-2026-20923

CVE-2026-20923 is a use-after-free in Windows Management Services that allows an authorized, locally situated attacker to elevate privileges. Evidence from Nessus/NVD/CVE records shows this CVE is associated with Windows Management Services and is listed among January 2026 security updates. Remed...

CVE-2026-26184

CVE-2026-26184 is a Buffer over-read in the Windows Projected File System that can enable local privilege elevation for an authenticated user. Connected sources confirm it is tracked under Windows Projected File System and that Microsoft has released security updates to fix vulnerabilities in Win...