Privilege escalation in Microsoft .NET's diagnostic runtime allows a network-reachable unauthenticated attacker - contingent on user interaction - to gain elevated privileges by supplying an externally controlled file path (CWE-73). The vulnerable component is Microsoft.Diagnostics.Runtime, embedded in Visual Studio 2026 (18.9.x) and Visual Studio 2022 (17.14.x), making developer workstations the primary target. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H and UI:R requirements meaningfully reduce practical exploitability despite the full C:H/I:H/A:H impact rating.
Out-of-bounds read (CWE-125) in the Windows Kerberos implementation enables unauthenticated remote denial of service across a broad swath of Microsoft Windows versions. An attacker who can send a crafted Kerberos request over the network can crash the Kerberos service, disrupting authentication for all domain-joined users and services on the affected host. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Windows Hello on Windows 10 and 11 allows an authorized local attacker to elevate privileges beyond their current security boundary by exploiting a race condition in a shared resource. The vulnerability requires high initial privileges and high attack complexity due to race timing constraints, but successful exploitation yields scope-changed full C:H/I:H/A:H impact - consistent with SYSTEM-level compromise. Microsoft has released cumulative updates for all affected Windows 10 and Windows 11 builds; no public exploit code has been identified at time of analysis.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released corrective patches across all affected build branches.
Remote denial-of-service in the Windows TCP/IP kernel stack allows an unauthenticated network attacker to exhaust kernel memory by sending crafted packets that trigger a memory allocation without a corresponding release (CWE-401), ultimately crashing or severely degrading affected systems. Affected releases span Windows Server 2022 and 2025, as well as Windows 11 versions 23H2 through 26H1, all with fixed builds published in the Microsoft Security Response Center update guide. No public exploit has been identified at time of analysis, and this vulnerability has not appeared in the CISA KEV catalog; however, the zero-authentication, low-complexity network vector makes the affected Windows TCP/IP stack a credible target for disruptive attacks against any internet- or network-exposed Windows deployment.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows unauthenticated remote attackers to crash the IKE service and deny VPN/IPsec negotiation to legitimate users. Affected systems span Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. Microsoft has released patches via the Security Response Center update guide; no public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds read in the Windows Device Health Attestation (DHA) service exposes sensitive memory contents to unauthenticated remote attackers. The flaw affects Windows 10 Version 1809, Windows Server 2019, 2022, and 2025, where a crafted network request can trigger the read beyond an allocated buffer, leaking high-confidentiality data. Microsoft has released patches for all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. Microsoft has released patched builds across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Input data manipulation in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions 9.0.0 through 9.0.2 allows unauthenticated remote attackers to submit improperly validated quantity values during the payment flow, per CVSS PR:N/AV:N/UI:N. CWE-1284 (Improper Validation of Specified Quantity in Input) in a payment gateway context typically enables transaction amount tampering - yet the vendor-assigned CVSS vector scores I:N/A:H, characterizing the impact as primarily availability disruption rather than integrity compromise, a direct contradiction with the 'Input Data Manipulation' label applied to the finding. Reported by TR-CERT; no public exploit or KEV listing identified at time of analysis.
Arbitrary OS command execution in electerm before 5.3.15 is achievable through a completely unvalidated Electron IPC bridge that exposes 40+ main-process functions - including openFileWithEditor and runGlobalAsync - to any renderer-side script without allowlisting function names or validating the sender's identity. An attacker who achieves renderer-side script execution (e.g., via XSS through malicious SSH server output or a compromised webview) can pivot directly into the main process and invoke system-level operations with no further authentication. No public exploit is identified at time of analysis, but the patch commit (b1f880534b8ae066c5d25bbf291ca7437e052750) is publicly available and makes the exploitation surface trivially reconstructible.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Missing authorization in the Hungarian WooCommerce pickup-points and shipping-labels plugin (versions before 4.2.8) allows unauthenticated remote attackers to perform actions that should be restricted to authorized users, resulting in high-integrity impact against affected WooCommerce stores. The flaw, classified as CWE-862 (Missing Authorization), means the plugin fails to verify whether the requesting party has the right to perform privileged operations - distinct from authentication failure. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.
Authorization bypass in IBM Enterprise Build of Quarkus 3.27.1-3.27.5 and 3.33.1-3.33.3 allows unauthenticated network attackers to access or modify resources belonging to other users or roles by manipulating URL query parameters. The root cause (CWE-639) is incorrect mapping of user-controlled query string values to authorization decisions, enabling an attacker to substitute an arbitrary object key and have the application honor the substituted identity without re-validating access rights. No public exploit code has been identified at time of analysis, but the C:H/I:H CVSS impact and network attack vector make this a meaningful risk for exposed deployments.
Session fixation in Adobe Photoshop Mobile for Android (versions ≤1.6.0.2294 and ≤1.6.0.2299) enables privilege escalation by allowing an attacker to pre-establish or predict a victim's session token before authentication completes. When a victim interacts with an attacker-controlled malicious webpage, the fixed session identifier persists into the authenticated state, granting the attacker access to sensitive Adobe resources with elevated privileges. The S:C scope change in the vendor's CVSS vector indicates the compromised session likely extends beyond the app itself to Adobe backend services such as Creative Cloud. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to disclose sensitive local files or cause a denial of service through maliciously crafted XML input. The vulnerability spans an extensive range of versions across the 09-xx through 11-xx release trains, indicating a long-lived parser misconfiguration in the middleware's XML processing subsystem. No public exploit code or active exploitation has been confirmed; Hitachi has released patches for the actively maintained branches.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Privilege escalation in Windows IP Address Management (IPAM) allows an authenticated local user on any of a broad range of unpatched Windows 10, 11, and Windows Server releases to obtain full system-level control by supplying a crafted serialized payload to the IPAM service. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 7.0 under a local, high-complexity attack vector with full C:H/I:H/A:H impact. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the complete impact triad makes successful exploitation severely damaging on any affected host.
Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.
Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. The leaked OAuth client secret can then be used to authenticate against Okta services outside the local machine, explaining the scope change in the CVSS vector and elevating the effective impact beyond a simple local information disclosure. No public exploit has been identified and the vulnerability is not listed in CISA KEV; Okta has released a patch at version 1.5.2.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.