CVE-2025-53779

CVE-2025-53779 is a Windows Kerberos Elevation of Privilege vulnerability. The flaw is described as a relative path traversal in Windows Kerberos that can allow an authorized attacker to elevate privileges over the network, potentially achieving domain administrator rights via the delegated Manag...

CVE-2024-49019

CVE-2024-49019 affects Active Directory Certificate Services (AD CS) and enables privilege escalation. The connected exploit resource demonstrates misuse of certificate-based authentication to obtain domain admin rights (e.g., requesting and using a certificate to gain LDAP/administrative access,...

CVE-2026-34348

CVE-2026-34348 affects the Windows Event Logging Service. The issue is a protection mechanism failure that can allow an authorized attacker to disclose information over a network. According to the available records, the exploit surface is network-based with low privileges required and no user int...

CVE-2026-45597

The CVE-2026-45597 issue affects Windows UI Automation Manager (uiamanager.dll). A race condition arises from concurrent execution with improper synchronization on a shared resource, enabling a local, authorized attacker to elevate privileges. Documents confirm the vulnerability type and impact (...

CVE-2026-65789

CVE-2026-65789 corresponds to a Windows DNS Server use-after-free vulnerability that enables remote code execution over a network. Based on the connected documents, the vulnerability is described as a use-after-free in Windows DNS which can allow an unauthorized attacker to execute code remotely....

CVE-2025-62221

CVE-2025-62221 is a local-elevation vulnerability in the Windows Cloud Files Mini Filter Driver (CLOUD FILES MINIFILTER DRIVER). It is a use-after-free condition in the driver that can allow an authorized local attacker to escalate to SYSTEM privileges. Public PoCs/Exploits exist (GitHub repos AB...

CVE-2026-40404

CVE-2026-40404 concerns a Windows Universal Disk Format (UDFS) File System Driver Elevation of Privilege. The vulnerability affects the UDFS component, with a local attack vector, requiring low privileges and no user interaction, and yields high impact to confidentiality, integrity, and availabil...

CVE-2026-50343

CVE-2026-50343, a Microsoft Install Service Elevation of Privilege vulnerability, arises from improper privilege management. An authorized local attacker could elevate privileges on affected Windows systems. The vulnerability is listed among several critical Windows privilege-escalation issues di...

CVE-2024-49046

CVE-2024-49046 affects the Windows Win32 Kernel Subsystem and is categorized as an Elevation of Privilege vulnerability. The CVSS 3.1 vector indicates LOCAL exploitability with LOW attack complexity and LOW privileges required, but HIGH impact to confidentiality, integrity, and availability under...

CVE-2025-21325

CVE-2025-21325 is described as a Windows Secure Kernel Mode Elevation of Privilege vulnerability. The provided data include a CVSS 3.1 vector indicating a local, low-complexity attack requiring low privileges with no user interaction, and impact to confidentiality, integrity, and availability rat...

CVE-2024-49105

CVE-2024-49105 affects the Windows Remote Desktop Client. It enables remote code execution over the network; exploitation requires user interaction and high privileges, with high impacts to confidentiality, integrity, and availability. CVSS v3.1 base score 8.4 (Network, Low attack complexity, Pri...

CVE-2025-21245

CVE-2025-21245 is a Windows Telephony Service remote code execution vulnerability. The CIRCL feed and CVE listings indicate it affects Windows Telephony Service with potential for executing code from an attacker-supplied payload (impact: execution of arbitrary code) and a CVSS v3.1 base score of ...

CVE-2026-62778

CVE-2026-62778 refers to a Windows DNS vulnerability described as a use-after-free in the DNS service that enables a remote attacker to elevate privileges over a network. The affected component is the Windows DNS service; the root cause is a use-after-free condition in DNS processing. The impact ...

CVE-2025-24068

CVE-2025-24068 describes a buffer over-read in the Windows Storage Management Provider that can lead to local information disclosure for an authenticated user. The issue affects Windows Storage Management Provider components and is rated with a local attack vector and a confidentiality impact. Co...

CVE-2025-59282

CVE-2025-59282 affects Inbox COM Objects. The vulnerability is a race condition caused by concurrent access to a shared resource, leading to potential local code execution by an authenticated attacker with local access. The score in public metrics lists a CVSS v3.1 base score of 7.0 (HIGH) with l...

CVE-2026-62819

CVE-2026-62819 corresponds to a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS). Available details indicate that the vulnerability resides in RRAS and could allow an attacker to gain unauthorized code execution on a victim’s machine via a network attack. Th...

CVE-2026-35421

CVE-2026-35421 describes a heap-based buffer overflow in Windows GDI that permits a local attacker to execute arbitrary code. The entry lists a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, LOW attack complexity, NO privileges required, user interaction required, and impacts to con...

CVE-2026-59126

The CVE refers to a race condition in Windows Event Logging Service where concurrent execution on a shared resource with improper synchronization can enable a local, authorized user to elevate privileges. Affected component: Windows Event Logging Service; root cause: race condition due to insuffi...

CVE-2025-27482

CVE-2025-27482 is a remote code execution vulnerability in Windows Remote Desktop Gateway Service caused by sensitive data being stored in memory that is not properly locked. The issue enables code execution over the network and is rated high-severity (CVSS 3.1: 8.1). Microsoft’s Patch Tuesday up...

CVE-2025-21273

Technical details are not publicly provided in the supplied documents. The CVE-2025-21273 entry lacks explicit affected product versions, root cause, or remediation specifics in this set; monitor for updates from Microsoft/MSRC.

CVE-2025-21369

CVE-2025-21369 is listed by the NCSC advisory as a vulnerability in Microsoft Windows’ Digest Authentication that enables executing arbitrary code. The advisory attributes an overall high severity (CVSS v3.1 base 8.80) with a network attack vector and impact. The connected document confirms the v...

CVE-2026-42985

CVE-2026-42985 is described in connected sources as a heap-based buffer overflow in the Remote Desktop Client that allows an unauthenticated attacker to execute code over the network. The initial and connected docs provide the vulnerability description and a high CVSS score (8.8, HIGH) with netwo...

CVE-2025-21211

Technical details about CVE-2025-21211 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories; no confirmed affected products, vectors, or fixes are described here.

CVE-2026-58608

CVE-2026-58608 affects Windows Print Spooler components, where a race condition from improper synchronization on a shared resource enables remote code execution over a network. The vulnerability allows an authenticated attacker with low privileges to execute code with high impact (C/H; I/H; A/H) ...

CVE-2025-21310

Technical details for CVE-2025-21310 are not publicly available in the provided documents. Monitor for updates from Microsoft and NVD.

CVE-2025-21329

CVE-2025-21329 is a MapUrlToZone Security Feature Bypass in Windows. Public docs identify it as a bypass of a security feature (CVE-2025-21329) with CVSS v3.1 base metrics indicating NETWORK attack vector, low attack complexity, no privileges required, user interaction required, and a MEDIUM seve...

CVE-2026-62820

CVE-2026-62820 concerns Windows DNS Server. The issue is a race condition caused by concurrent execution using a shared resource with improper synchronization, leading to remote code execution over a network. Affected product is Windows DNS Server; the vulnerability is triggered via network acces...

CVE-2026-62822

CVE-2026-62822 describes an integer overflow/wraparound in Windows GDI+ that allows an unauthenticated attacker to execute code remotely over a network. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8 ( HIGH ), indicating high impact for confidentiality, integ...

CVE-2025-21191

CVE-2025-21191 affects Windows Local Security Authority (LSA) with a time-of-check/time-of-use race condition that enables an authorized local attacker to elevate privileges (obtaining increased entitlements). The vulnerability is categorized under local privilege escalation and is documented in ...

CVE-2025-21260

Technical details about CVE-2025-21260 are not publicly provided in the connected documents. Monitor for updates from Microsoft and CVE sources for affected components, impact, and remediation.

CVE-2025-21340

Technical details about CVE-2025-21340 are not provided in the supplied Connected documents. The entry concerns Windows VBS security feature bypass; no affected products/versions or patch specifics are disclosed here. Monitor for updates from Microsoft.

CVE-2026-65679

Summary: CVE-2026-65679 is a heap-based buffer overflow in the Windows iSCSI Target Service that allows remote code execution over a network. The vulnerability arises from an out-of-bounds write handling, enabling an unauthenticated attacker to execute code on affected systems. The CVSSv3.1 vecto...

CVE-2024-43641

CVE-2024-43641 is a Windows Registry Elevation of Privilege issue. The connected documents reveal a sophisticated exploitation path based on hive memory corruption and out-of-bounds cell indexes, enabling an unprivileged actor to obtain arbitrary kernel read/write access and, ultimately, SYSTEM-l...

CVE-2024-49120

Technical details for CVE-2024-49120 are not publicly available in the provided documents. Monitor for updates from Microsoft and security advisories; this dataset does not disclose affected products, vectors, or fixes.

CVE-2025-21338

CVE-2025-21338 is a GDI+ Remote Code Execution vulnerability. The CVE affects Windows components that use GDI+ and has a CVSSv3.1 base score of 7.8 (HIGH) with LOCAL attack vector, LOW privileges required, no user interaction, and impacts to confidentiality, integrity, and availability as describ...

CVE-2026-21513

CVE-2026-21513 is a security feature bypass vulnerability in the MSHTML Framework. Affected component: MSHTML/MSHTML Framework used by Windows’ browsing/rendering stack. Root cause details are described in vendor advisories and security blogs as a protection mechanism bypass that can be triggered...

CVE-2025-24990

CVE-2025-24990 is a local privilege escalation in the Microsoft‑supplied Agere Modem Driver (ltmdm64.sys). The issue is described as an untrusted pointer dereference within the driver, enabling a local attacker to escalate privileges to administrator. Microsoft addressed it by removing the driver...

CVE-2025-47160

The CVE-2025-47160 entry applies to Windows Shell and describes a Protection mechanism failure that allows a remote attacker to bypass a security feature over the network. The NVD entry lists a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), indicating a network-exposed issue w...

CVE-2025-21326

Technical details for CVE-2025-21326 are not publicly provided in the supplied documents. Monitor for updates from Microsoft MSRC and regional advisories; current sources mention Internet Explorer RCE and related KB updates without detailing exploit vectors.

CVE-2025-24997

CVE-2025-24997 is a Windows Kernel Memory vulnerability described as a null pointer dereference that enables a local, authorized attacker to cause a Denial-of-Service. The CVE is cataloged with a low to medium severity profile (MSFT-cited CVSSv3.1: AV L, AC L, PR High, UI None, S U, C N, I N, A H...

CVE-2025-29828

CVE-2025-29828 (Windows Schannel Remote Code Execution) affects Windows Cryptographic Services. Description confirms missing release of memory after effective lifetime, enabling a remote attacker to execute code over a network. CVSS 3.1/3.1.0 base 8.1 (High) with network vector, no user interacti...

CVE-2026-62817

CVE-2026-62817 describes an out-of-bounds write in Windows DNS Server that enables remote code execution by an unauthenticated attacker over an adjacent network. The advisory consistently identifies the affected component as Windows DNS Server and cites a high-severity impact (CVSS v3.1: 8.8, AV:...

CVE-2026-62890

CVE-2026-62890 is a heap-based buffer overflow in Windows GDI+ that allows an authorized attacker to execute code locally. CVSS v3.1 base score 7.8 (HIGH) with LOCAL attack vector, requiring LOW privileges and no user interaction; impact to confidentiality, integrity, and availability is HIGH. No...

CVE-2025-21274

CVE-2025-21274 corresponds to a Windows Event Tracing Denial of Service vulnerability. The NVD entry rates impact as Denial of Service with a CVSSv3.1 base score of 5.5 (Local, Low UI, privileges required: Low, Availability impact: High). Connected sources indicate this vulnerability affects Wind...

CVE-2025-21382

CVE-2025-21382 affects the Microsoft Windows Graphics Component. It is a local elevation-of-privilege vulnerability in the graphics driver component, with a CVSSv3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Connected sources indicate that public exploits exist. Microsoft has issue...

CVE-2025-21419

CVE-2025-21419 is a Windows Setup cleanup vulnerability that enables local elevation of privilege. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates an attacker with low privileges and local access can achieve high integrity and availability impact, without user interaction. The...

CVE-2026-42836

CVE-2026-42836: A race condition due to improper synchronization in the Windows Function Discovery Service (fdwsd.dll) enables a locally authenticated attacker to escalate privileges. The issue is described as a concurrency problem with a shared resource. Affected component: Function Discovery Se...

CVE-2024-49117

CVE-2024-49117 is a Windows Hyper-V remote/code execution vulnerability with a local attack vector and high impact (confidentiality, integrity, availability all High). The available connected documents indicate the issue is addressed by Microsoft updates, notably KB5048685 (OS builds 22621.4602/2...

CVE-2025-26644

CVE-2025-26644 affects Windows Hello by allowing local spoofing due to inadequate handling of adversarial input perturbations. Microsoft documents a Windows Hello security fix path via monthly updates (e.g., KB5055528 for Windows 11 22621/22631; KB5055519 for older Windows builds) that enforces v...

CVE-2025-26652

CVE-2025-26652 describes a Denial-of-Service vulnerability in Windows Standards-Based Storage Management Service caused by uncontrolled resource consumption, allowing an unauthenticated, network-originating attacker to deny service. Affected are Windows systems where this storage service is prese...