Sensitive credential leakage in Red Hat insights-client exposes cloud.openshift.com pull-secret tokens through application log files on Advanced Cluster Management hub clusters. When insights-client receives any non-200 HTTP response from the Red Hat cloud endpoint, it writes the full request headers - including the long-lived pull-secret bearer token - to pod logs readable by local cluster users. An attacker who harvests this token can authenticate against Red Hat cloud services without possessing their own credentials. No public exploit has been identified at time of analysis, and multiple vendor-released errata patch the behavior.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows an unauthenticated adjacent-network attacker to crash or disable the wireless subsystem on affected systems. The flaw stems from an improper conditions check (CWE-754) within the WiFi driver stack, meaning edge-case or malformed network input is not handled safely, leading to complete availability loss of the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, zero-privilege attack vector makes this straightforward to trigger from WiFi range.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Denial-of-service in Intel PROSet/Wireless WiFi Software for Windows (Ring 2 device driver layer) allows an unauthenticated adjacent-network attacker to crash or disable the wireless driver with no user interaction. The flaw stems from an improper conditions check (CWE-754) in the driver, yielding complete loss of wireless availability on the affected system and minor downstream availability impact on subsequently connected systems. No public exploit or CISA KEV listing exists at time of analysis, and Intel has published an advisory at INTEL-SA-01422.
Path traversal (CWE-23) in Zoom VDI Client and Plugins exposes authenticated local users to information disclosure and potential file integrity impact by allowing directory escape via crafted path input. Affected are all tracked versions under cpe:2.3:a:zoom_communications:zoom_vdi. No public exploit code or CISA KEV listing exists at time of analysis, but the High confidentiality and integrity impact ratings warrant prompt patching in VDI environments where insider or post-compromise scenarios are relevant threats.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Integer overflow in Vim's text-property subsystem (prior to 9.2.0841) allows a crafted file to wrap a uint16_t line-property counter from 0xffff to zero, causing prop_add_one() in src/textprop.c to copy existing text-property records into a heap allocation sized for zero entries. The resulting heap corruption can yield high-impact confidentiality, integrity, and availability consequences on the local user's process. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.1 (AV:L/AC:H) reflects meaningful risk for users who open untrusted files in Vim.
Missing authorization in OpenIM Server v3.8.3 allows any authenticated user to invoke admin-only REST API endpoints and enumerate the entire platform's user and group data. The GetPaginationUsers, GetAllUserID, and GetGroups RPC handlers in internal/rpc/user/user.go and internal/rpc/group/group.go lack the required authverify.CheckAdmin() guard, meaning a regular bearer token is sufficient to harvest all user IDs, nicknames, manager-level flags, and full group listings including private groups the caller has never joined. No public exploit has been identified at time of analysis, but the low attack complexity makes opportunistic exploitation trivial for any credentialed platform user.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Privilege escalation in Windows Telephony Service (TAPI) via a use-after-free memory corruption flaw enables a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected hosts. The vulnerability spans a broad range of Microsoft Windows versions from Server 2012 through Windows 11 26H1 and multiple Windows Server 2022/2025 builds, confirmed by Microsoft MSRC and catalogued under EUVD-2026-56640. No public exploit code or active exploitation has been identified at time of analysis, though the pervasive Windows deployment footprint makes patch deployment a meaningful operational priority.
Privilege escalation via use-after-free memory corruption in the Windows Telephony Service (TAPI) affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An authorized local attacker with low-privilege credentials can exploit a race condition to corrupt freed memory within the telephony service process, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed by CISA KEV, and no public exploit has been identified at time of analysis; Microsoft has released patched builds for all affected platforms.
Local privilege escalation in the Windows Telephony Service (TAPI) allows an already-authenticated, low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans a wide range of Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the availability of a vendor patch make patching urgent in environments where Telephony Service is active.
Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.
Privilege escalation in Windows Installer (msiexec) on Windows 11 and Windows Server 2025 allows a locally authenticated low-privileged user to gain SYSTEM-level privileges by exploiting a use-after-free memory corruption condition. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core deployments. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.
Local code execution in the Windows DHCP Client exposes Windows 11 and Windows Server 2025 systems to privilege escalation by authorized local users via a use-after-free memory corruption condition. The flaw (CWE-416) requires high attack complexity - consistent with race-condition-dependent UAF exploitation - and an existing local foothold (PR:L, AV:L), limiting its practical reach compared to its full C:H/I:H/A:H impact triad. No public exploit has been identified at time of analysis, and Microsoft has released a vendor-confirmed patch.
Local privilege escalation in the Windows Graphics Kernel exposes a broad range of Windows 10, Windows 11, and Windows Server editions to a use-after-free memory corruption flaw (CWE-416). An attacker holding a low-privileged local account who can satisfy a race condition in the kernel graphics subsystem can gain SYSTEM-level control of the affected host. Microsoft has released patches across all identified product lines; no public exploit has been identified at time of analysis.
Privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver affects Windows 10, 11, and Server 2016 through 2025, enabling a low-privileged local attacker to achieve full kernel-level control via a use-after-free memory corruption in a kernel-mode driver. The CVSS AC:H rating indicates the exploit path likely requires precise timing - consistent with a race condition in driver memory management - which reduces but does not eliminate real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch from Microsoft is available.
Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.
Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Autopilot on Windows 11 versions 24H2 and 25H2 arises from a use-after-free memory corruption flaw, enabling a local low-privileged attacker to achieve full SYSTEM-level access with complete confidentiality, integrity, and availability impact. High attack complexity (AC:H) constrains opportunistic exploitation, making this most relevant to insider threat and post-breach lateral movement scenarios rather than broad automated attacks. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Autopilot on Windows 11 (versions 24H2 and 25H2) allows a low-privileged authenticated local attacker to achieve full system compromise through a use-after-free memory corruption flaw (CWE-416). The CVSS vector (AV:L/AC:H/PR:L) confirms local access with elevated complexity - consistent with a race condition or specific heap state requirement inherent to UAF exploitation. Microsoft has released patches at builds 10.0.26100.9168 and 10.0.26200.9168; no public exploit or CISA KEV active exploitation listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Autopilot on Windows 11 allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level or elevated access. The vulnerability stems from improper memory management in the Autopilot provisioning component, where a freed memory region can be referenced again under a race condition (AC:H). Affected builds span both Windows 11 24H2 and 25H2 prior to the 9168 patch revision; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in Windows Autopilot on Windows 11 (24H2 and 25H2) enables a locally authenticated, low-privileged user to escalate privileges, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack requires local access and high complexity (AV:L/AC:H/PR:L), meaning an attacker must meet specific memory state or race conditions - reducing opportunistic risk but not eliminating it for determined local threat actors. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Autopilot on Windows 11 versions 24H2, 25H2, and 26H1 contains a double-free memory corruption flaw that allows a locally authenticated, low-privileged attacker to escalate to full system privileges. The vulnerability carries a CVSS 3.1 score of 7.0 with high attack complexity (AC:H), meaning reliable exploitation requires specific conditions or timing to be met rather than being trivially reproducible. A vendor-released patch is available via the Microsoft Security Response Center, and no public exploit has been identified at time of analysis.
Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.
Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.
Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in Windows HTTP.sys enables a locally authenticated, low-privileged attacker to escalate privileges on the affected host, likely achieving SYSTEM-level control. The flaw spans a wide range of Windows versions from Server 2012 through Windows 11 26H1, representing substantial enterprise exposure despite requiring initial local access. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines via the MSRC advisory.
Local privilege escalation via use-after-free (CWE-416) in the Windows Telephony Service (TAPI) affects every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized low-privileged local attacker can trigger improper memory lifecycle management in the privileged tapisrv process, achieving full confidentiality, integrity, and availability impact on the compromised system. No public exploit code has been identified at time of analysis and high attack complexity constrains opportunistic mass exploitation, but vendor-released patches are available and should be prioritized given the ubiquitous deployment footprint.
Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.
Local privilege escalation via race condition in Windows Telephony Service affects a sweeping range of Microsoft Windows client and server editions, from Server 2012 through Windows 11 26H1. An authorized local attacker with low-privileged access can exploit improper synchronization over a shared resource to elevate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the breadth of affected Windows versions across enterprise environments makes unpatched exposure a meaningful operational risk.
Privilege escalation in Windows Telephony Service affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized local attacker exploits an improper synchronization flaw (CWE-362) in shared resource access within the telephony subsystem to elevate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability impact. Microsoft has released patched builds; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation via a time-of-check time-of-use (TOCTOU) race condition in the Windows Common Log File System (CLFS) Driver affects a broad range of Windows client and server versions from Server 2012 through Windows 11 25H2/26H1. A low-privileged local attacker can exploit the race window to gain SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available from Microsoft via the MSRC update guide.
Privilege escalation in the Windows Bind Filter Driver exposes Windows 11 systems across three active release tracks to full SYSTEM-level compromise by locally authenticated low-privilege users exploiting a kernel race condition. Rated CVSS 7.0 with high attack complexity, the vulnerability reflects a timing-dependent flaw in shared kernel resource access rather than a simple code injection. No public exploit identified at time of analysis, and the vulnerability is absent from CISA KEV; Microsoft has released patches for all confirmed affected builds.
Windows MIDI Service Module on Windows 11 contains a race condition enabling a locally authenticated low-privileged attacker to escalate privileges to a higher-integrity context, with full confidentiality, integrity, and availability impact upon success. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 below specific patch thresholds confirmed by ENISA EUVD-2026-56345. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity (AC:H) reflects the timing-dependent nature of race condition exploitation, moderating real-world risk relative to the CVSS base score of 7.0.
Local privilege escalation in Windows Push Notifications exposes a broad range of Microsoft Windows desktop and server editions to full SYSTEM-level compromise by an authenticated low-privileged local attacker. The flaw is a race condition (CWE-362) in which concurrent threads access a shared resource without adequate synchronization, creating a timing window that can be manipulated to corrupt execution state and redirect control to a privileged context. Microsoft has confirmed the issue and released patches across all affected Windows build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Bind Filter Driver (bindflt.sys) permits a low-privileged local attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025 by exploiting a race condition that triggers a use-after-free in kernel memory. Affected builds span Windows 11 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations; Microsoft has released patched builds via the MSRC update guide. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.
Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file write in AVideo's aVideoEncoderChunk.json.php endpoint allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests, requiring no credentials of any kind. All AVideo versions (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) with this endpoint network-exposed are affected, as confirmed by the patch commit diff which shows authentication gating was entirely absent prior to the fix. Exploitation can cause denial of service via disk exhaustion, corrupt the video encoding pipeline, or - when chained with a local file inclusion vulnerability - escalate to remote code execution; no public exploit has been identified at time of analysis.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.