Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).
Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixes, but SSVC reports no observed exploitation and EPSS is very low (0.04%), so this is a patch-on-schedule kernel EoP rather than an emergency; no public exploit identified at time of analysis. Because Cloud Files underpins OneDrive/cloud sync placeholders, the driver is present on effectively every modern Windows install.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across supported Windows 10, Windows 11 (through 26H1) and Windows Server 2019-2025 builds. Microsoft has released fixes; there is no public exploit identified at time of analysis, EPSS risk is very low (0.04%), and it is not listed in CISA KEV. Despite 'Denial Of Service' tagging, the CVSS vector rates full confidentiality, integrity and availability impact, consistent with a kernel EoP.
Local privilege escalation in Windows TCP/IP stack affects Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2012 through a race condition vulnerability. Low-complexity exploitation requires only low-privilege authenticated access with no user interaction (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Vendor-released patch available from Microsoft Security Response Center. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity and local vector suggest feasibility for post-compromise privilege escalation in enterprise environments.
Windows Event Logging Service privilege escalation allows local authenticated attackers with low-level privileges to gain SYSTEM-level control across Windows 10, Windows 11, and Windows Server 2012+ environments. The vulnerability requires no user interaction and has low attack complexity (AC:L), making exploitation straightforward once initial access is obtained. Microsoft has released patches via their March 2026 security updates, and exploitation requires only standard user credentials on vulnerable systems. CVSS 7.8 HIGH severity with complete compromise of confidentiality, integrity, and availability upon successful exploitation.
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) stems from a Use-After-Free memory corruption flaw (CWE-416) that runs code in the context of the current user when a crafted project or media file is opened. Reported by Adobe and tracked as APSB26-46/EUVD-2026-29610, it carries a CVSS 7.8 (local vector, user interaction required); there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 10th percentile). The tagged secondary impact is denial of service, but the confirmed primary risk is RCE at user privilege.
Arbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted asset or project file, running attacker code in the context of the current user. The flaw was reported by Adobe and patched in advisory APSB26-52; there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 8th percentile). SSVC records no known exploitation, but the technical impact is rated total.
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. No public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile), consistent with SSVC 'Exploitation: none.' The flaw is Adobe-reported (APSB26-52) and requires local file-open user interaction rather than remote network access.
Arbitrary code execution in Adobe Illustrator versions 29.8.6, 30.3 and earlier arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, letting an attacker run code with the privileges of the current user. It affects desktop installations of both the 29.x and 30.x release trains and was reported by Adobe PSIRT under advisory APSB26-51. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.
Arbitrary code execution in Adobe Substance 3D Painter versions 12.0.2 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, executing code in the context of the current user. The flaw was reported by Adobe PSIRT and is fixed per advisory APSB26-55; there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03%. Exploitation is local and requires user interaction, limiting it to social-engineering-driven file-opening attacks rather than remote automated compromise.
Arbitrary code execution in Adobe Substance 3D Painter (versions 12.0.2 and earlier) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, so exploitation is file-borne and requires user interaction. There is no public exploit identified at time of analysis, KEV does not list it, and the EPSS score is very low (0.03%), indicating no observed or expected mass exploitation.
Arbitrary code execution in Adobe Illustrator 29.8.6, 30.3 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running code in the context of the current user. Only local file-open exploitation applies (CVSS 7.8, AV:L), and there is no public exploit identified at time of analysis; EPSS is very low at 0.03% (7th percentile) and CISA SSVC lists exploitation as none, indicating no observed attacks despite total technical impact.
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write when parsing a malicious file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a crafted file, so it is a local, user-interaction-dependent flaw rather than a remotely triggerable one. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously crafted asset file, triggering an out-of-bounds write in the application's file parser and running attacker code with the current user's privileges. Adobe self-reported the flaw; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with SSVC's assessment of no observed exploitation.
Arbitrary code execution in Adobe After Effects (versions 26.0, 25.6.4 and earlier) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file that triggers an integer overflow (CWE-190). Only user-assisted local exploitation is possible (CVSS 7.8, AV:L/UI:R), there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), consistent with SSVC 'Exploitation: none'.
Arbitrary code execution in Adobe After Effects 26.0, 25.6.4 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%), but the CVSS 3.1 base score is 7.8 (High) with total technical impact. Adobe has published a patch in advisory APSB26-48.
Arbitrary code execution in Adobe After Effects 26.0, 25.6.4 and earlier arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted project or media file, letting an attacker run code in the context of the current user. Adobe self-reported the issue and released a patch via advisory APSB26-48. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with SSVC marking exploitation as 'none'.
Arbitrary code execution in Adobe Media Encoder 26.0.2, 25.6.4 and earlier lets an attacker run code in the context of the current user when a victim opens a maliciously crafted media file. The flaw is an integer overflow (CWE-190) during file parsing; exploitation requires local user interaction and is not remotely triggerable. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with CISA SSVC recording no known exploitation.
Arbitrary code execution in Adobe Media Encoder (versions 26.0.2, 25.6.4 and earlier) stems from an out-of-bounds write (CWE-787) that executes in the context of the current user when a victim opens a crafted media file. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), consistent with the SSVC 'Exploitation: none' assessment despite the total technical impact rating. Successful exploitation requires local user interaction, making this a file-lure attack rather than a remote-service threat.
Arbitrary code execution in Adobe Premiere Pro 26.0.2, 25.6.4 and all earlier versions arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted project or media file, running attacker code in the context of the current user. The flaw is vendor-reported (Adobe APSB26-46) with no public exploit identified at time of analysis; EPSS is very low at 0.03% (7th percentile) and CISA SSVC records exploitation status as none, though technical impact is rated total. Exploitation is local and requires user interaction, so risk is bounded by social-engineering delivery rather than remote automated attack.
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) arises from an out-of-bounds write triggered when a victim opens a maliciously crafted project or media file, letting an attacker run code in the context of the current user. The flaw was reported by Adobe and addressed in advisory APSB26-46; it carries a CVSS 7.8 (High) score but a very low EPSS of 0.03%, and CISA SSVC records no observed exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Command injection in protobufjs-cli pbts tool allows arbitrary shell command execution when processing file paths with shell metacharacters. The pbts utility builds JSDoc commands by concatenating unsanitized file paths into shell strings executed via child_process.exec. Affects protobufjs-cli versions ≤1.2.0 and 2.0.0-2.0.1. Vendor-released patches available (1.2.1 and 2.0.2). CVSS 7.8 (High) but requires local access with user interaction (AV:L/UI:R), limiting remote exploitation. No EPSS data or KEV listing indicates this is not yet widely exploited despite public disclosure and available fixes.
Arbitrary code execution in Adobe After Effects 26.0, 25.6.4 and all earlier versions arises from a stack-based buffer overflow (CWE-121) triggered when a victim opens a maliciously crafted project or media file, running code in the context of the current user. Reported by Adobe and tracked in APSB26-48, it carries a CVSS 7.8 (High) with a local attack vector and required user interaction; there is no public exploit identified at time of analysis, and the EPSS score is 0.01% (1st percentile). SSVC indicates no observed exploitation but total technical impact, making this a patch-on-schedule priority rather than an emergency.
Local privilege escalation in Ivanti Endpoint Manager agent allows authenticated users to gain SYSTEM-level privileges via incorrect file or registry permissions. Affects all versions prior to 2024 SU6. Vendor has released a patch (version 2024 SU6). No evidence of active exploitation or public POC identified at time of analysis, though EPSS data not available. Organizations running EPM agents on managed endpoints should prioritize patching given the high CVSS score (7.8) and potential for lateral movement across enterprise environments.
Race condition in Ivanti Secure Access Client enables local privilege escalation to SYSTEM from low-privileged accounts. Affects versions before 22.8R6. An authenticated local user can exploit timing vulnerabilities in the client software to gain complete system control. While limited to local attack vector (requires existing access to the target system), the low attack complexity (AC:L) and lack of user interaction requirement (UI:N) make this exploitable once local access is achieved. No public exploit code identified at time of analysis, and EPSS risk scoring not yet available for this 2026 CVE.
Remote code execution in protobufjs (npm package) versions ≤7.5.5 and 8.0.0-8.0.1 allows attackers to inject and execute arbitrary JavaScript by supplying a malicious protobuf schema with crafted default values in bytes fields. When applications load untrusted protobuf descriptors and call toObject() with defaults enabled, attacker-controlled expressions are emitted into generated conversion functions and executed in the application context. Vendor-released patches are available in versions 7.5.6 and 8.0.2. No public exploit code identified at time of analysis, though the vulnerability is straightforward to weaponize given the clear preconditions in the advisory.
Server-Side Request Forgery in Xibo CMS versions prior to 4.4.1 lets an authenticated user with Library upload permissions coerce the CMS server into issuing arbitrary HTTP requests to internal or external hosts. This enables internal network scanning, reaching cloud instance-metadata endpoints such as AWS IMDS, pivoting to unauthenticated internal services, and data exfiltration. No public exploit identified at time of analysis; EPSS is low (0.03%, 9th percentile) and CISA SSVC records exploitation as none.
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to extract sensitive database contents through time-based or boolean queries. The vulnerability enables cross-scope confidentiality breach with high impact (CVSS:C:H), permitting unauthorized access to all WordPress database information including user credentials, private travel booking details, and payment data. EPSS data unavailable; no CISA KEV listing indicates exploitation remains targeted rather than widespread. Patchstack's inclusion in their vulnerability database suggests active researcher interest and potential proof-of-concept development.
Authorization bypass in Heym's workflow execution engine (versions before 0.0.21) allows any authenticated user to run workflows belonging to other users by referencing the victim's workflow UUIDs, exposing their outputs and triggering side-effecting nodes. The root cause is missing access validation on subworkflow and execute-node references (CWE-863), fixed upstream in pull request #93. No public exploit has been identified at time of analysis, and EPSS scores it at just 0.05% with CISA SSVC marking exploitation as 'none' - but SSVC rates the technical impact as total.
Blind SQL injection in BEAR woo-bulk-editor plugin for WordPress up to version 1.1.7.1 allows high-privilege authenticated administrators to extract database contents through specially crafted SQL queries. The scope change in CVSS (S:C) indicates potential impact beyond the plugin itself, enabling access to other WordPress data or resources. No public exploit code or active exploitation indicators identified at time of analysis, but Patchstack public disclosure increases weaponization risk.
Session fixation in Pandora FMS versions 777-800 enables session hijacking when attackers supply crafted session IDs to users. Successful exploitation grants attackers complete access to victim user sessions with high confidentiality and integrity impact. No public exploit code identified at time of analysis, though attack complexity is low with network-based delivery requiring only user interaction (CVSS 7.6).
SQL injection in Pandora FMS versions 777-800 allows authenticated attackers with low privileges to exfiltrate or manipulate database contents via the graph container parameter. Attack complexity is high with present attack techniques, requiring specific timing conditions. No active exploitation confirmed per CISA KEV, and EPSS data not provided. Vendor advisory available from PandoraFMS confirms the vulnerability affecting a narrow version range spanning approximately builds 777 through 800.
Remote unauthenticated attackers can crash Zyxel NWA1100-N access points running customized firmware version 1.00(AACE.1)C0 by sending malformed HTTP requests that trigger buffer overflows in five distinct web server functions (formWep, formWlAc, formPasswordSetup, formUpgradeCert, formDelcert). The vulnerability enables denial-of-service attacks with high CVSS 7.5 severity but is limited to an end-of-life product according to Zyxel's reference documentation. No public exploit code identified at time of analysis, and EPSS data is unavailable for this recent CVE.
Denial of service in the Microsoft Windows TCP/IP stack (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a remote, unauthenticated attacker to crash the affected system by triggering a null pointer dereference over the network. No public exploit has been identified at time of analysis and the EPSS probability is low (0.14%, 34th percentile), but the flaw is network-reachable with no privileges or user interaction and CISA SSVC rates it automatable. Impact is limited to availability - no code execution or data disclosure.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated remote attacker to overflow a heap buffer in a network management service and run arbitrary code as a privileged OS user, or trigger a denial-of-service crash of the affected process. It affects Aruba mobility controllers and gateways across multiple 8.x and 10.x branches. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.12%, 30th percentile), and notably the vendor CVSS vector scores only availability impact despite the RCE claim.
SQL injection in the AIWU AI Chatbot WordPress plugin (versions ≤1.4.17) allows remote unauthenticated attackers to extract sensitive database contents via the getListForTbl() function due to unsanitized user input in SQL queries. Partial mitigation exists in version 1.4.11+ through administrator-only nonce protection, but the underlying SQL injection vulnerability persists. CVSS 7.5 (High) reflects network-accessible unauthenticated exploitation with high confidentiality impact. Wordfence provides detailed vulnerable code references across multiple plugin files including controller.php, req.php, and model.php. No evidence of active exploitation (not in CISA KEV) at time of analysis.
Improper authorization in Adobe Commerce (Magento) 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker (CVSS PR:N) bypass a security control and gain unauthorized write access to the affected system, with no user interaction. There is no public exploit identified at time of analysis and the EPSS score is low (0.09%), but the network-reachable, no-auth, no-interaction vector combined with Adobe's own reporting warrants prompt patching. This is not in CISA KEV and shows no confirmed exploitation.
Improper authorization in Adobe Commerce (Magento) lets remote unauthenticated attackers bypass security controls and gain unauthorized write access across builds 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. The flaw (CWE-863) requires no user interaction and is exploitable over the network per its CVSS:3.1 vector, though there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low (0.09%, 26th percentile), but CISA SSVC marks it 'Automatable: yes', meaning any working exploit could be scaled easily.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker crash a network management service by sending specially crafted packets, terminating the service process and disrupting normal controller operations. Affected releases include AOS 8.10.x, 8.12.x, and 8.13.x up to the fixed builds. There is no public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none' - this is a patch-worthy availability issue rather than an active threat.
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
SQL injection in the Court Reservation - Manage Your Court Bookings Online WordPress plugin (versions ≤ 1.10.11) lets unauthenticated attackers inject arbitrary SQL through the 'id' parameter, enabling extraction of sensitive database contents such as user credentials and booking data. The flaw stems from an unescaped, unprepared query and is network-reachable with no authentication or user interaction. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), but SSVC flags exploitation as automatable with partial technical impact.
Information disclosure in the Windows TCP/IP networking stack allows a remote, unauthenticated attacker to read sensitive memory contents over the network by triggering a use-after-free condition. All supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) are affected. Microsoft-reported with no public exploit identified at time of analysis; EPSS is low (0.06%, 19th percentile) and CISA SSVC records exploitation status as none.
Unauthenticated remote attackers can modify or delete arbitrary memory records in mem0 1.0.0 server by directly calling unprotected API endpoints including PUT /memories/{memory_id}. The vulnerability stems from complete absence of authentication and authorization controls on critical memory management functions, allowing data manipulation and loss without any verification of requester identity. EPSS score of 0.06% (18th percentile) indicates low exploitation probability in the wild, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.