SQL Server information disclosure via buffer over-read (CWE-126) allows an authenticated low-privilege network attacker to read memory contents beyond an intended buffer boundary, potentially exposing sensitive in-process data. The flaw spans SQL Server 2017, 2019, 2022, and 2025 across both GDR and Cumulative Update servicing branches, making the affected population broad. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the network-accessible, low-complexity attack path warrants timely patching given the enterprise prevalence of SQL Server.
Information disclosure in Microsoft SQL Server 2025 allows an authenticated, low-privileged network attacker to extract sensitive data through crafted SQL error messages. Affected are the CU8 and GDR servicing branches of SQL Server 2025, with both patch channels receiving fixes. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS C:H rating indicates the potential for significant confidentiality breach once an attacker has any valid credential.
Out-of-bounds read in Microsoft SQL Server 2017 and 2019 exposes sensitive memory contents to remote unauthenticated attackers over the network. The flaw (CWE-125) exists in a network-accessible SQL Server component and is reachable without authentication, though user interaction is required (CVSS UI:R). Microsoft has released patched builds for all affected servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (2016 through 365 Apps for Enterprise and LTSC 2024) enables an unauthenticated remote attacker to disclose sensitive memory contents over a network, per the provided CVSS vector. Affected products span both perpetual-license and subscription editions across x64 and x86 architectures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Multi-factor authentication bypass in XenForo before 2.3.13 allows a network-accessible authenticated attacker who knows a target account's password to complete login as that user without possessing their registered passkey. The WebAuthn assertion handler performs a global credential lookup that accepts any registered passkey - including the attacker's own - without verifying the credential belongs to the user whose session is pending, nullifying the passkey TFA layer. Both public forum and admin control panel (ACP) login paths are vulnerable. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Unauthenticated remote denial-of-service in the Windows DHCP Server service across a broad range of Windows Server builds (2012 through 2025) stems from a type confusion flaw (CWE-843) in packet-processing logic. A network-adjacent or remote attacker can send a malformed DHCP packet that causes the server process to access a resource using an incompatible type, crashing the DHCP service and halting IP address assignment for all dependent clients. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but the zero-authentication requirement and broad version footprint make this a practical target.
Type confusion (CWE-843) in the Windows DHCP Server service allows an unauthenticated remote attacker to crash the service, causing denial of service across the network. The flaw affects all major Windows Server generations from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809, wherever the DHCP Server role is active. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.
Type confusion (CWE-843) in Windows DHCP Server enables unauthenticated remote denial of service across an extensive range of Windows Server releases, from Windows Server 2012 through Windows Server 2025. An attacker on the network can send a malformed DHCP packet that triggers incompatible type access in the DHCP service, crashing it and disrupting IP address assignment for all network clients served by that host. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a straightforward network-reachable DoS.
Out-of-bounds read in Windows DHCP Server (CWE-125) allows unauthenticated remote attackers to crash the DHCP service, denying IP address assignment to all clients on affected subnets. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds with the DHCP Server role enabled. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis, but the AV:N/PR:N attack surface on a critical network infrastructure service warrants prompt patching.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service enables an unauthenticated remote attacker to crash the service by sending a crafted network packet, resulting in denial of DHCP service to all network clients. All actively supported Windows Server releases from 2012 through 2025 are affected, as is Windows 10 versions 1607 and 1809 with the DHCP Server role installed. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote denial-of-service in the Windows DHCP Server role allows network-accessible attackers to crash the DHCP service by sending malformed packets that trigger an out-of-bounds read (CWE-125). Affected versions span Windows Server 2012 through Windows Server 2025, all requiring the DHCP Server role to be installed and running. Microsoft has released patches for all supported versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.
Out-of-bounds read in the Windows DHCP Server role exposes all supported Windows Server versions - from Server 2012 through Server 2025 - to unauthenticated network-based denial of service. An attacker on the network can send a specially crafted DHCP packet that triggers the CWE-125 read violation, crashing or hanging the DHCP service and severing lease renewal for all network clients served by that instance. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privileged attacker to crash the database engine remotely, causing a denial of service. The flaw (CWE-125) is reachable over the network with no user interaction required, making it suitable for disrupting database availability from any network-connected authenticated session. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected major versions.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Path traversal in Visual Studio Code (all versions prior to 1.136.2) allows a remote unauthenticated attacker to write files outside the intended restricted directory, achieving high-integrity tampering on the victim's system over a network. The attack requires user interaction - a victim must open or process attacker-controlled content within VS Code - which limits automatability. No active exploitation has been identified; SSVC assessment confirms exploitation status as none with partial technical impact. Microsoft has released a fix in version 1.136.2.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Buffer over-read (CWE-126) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to trigger server-side memory disclosure. The flaw causes the SQL Server engine to read past an allocated buffer boundary and return excess memory contents to the caller over the network connection, potentially exposing in-memory data from other sessions or internal state. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial, making this a moderate-priority patch cycle item.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to disclose potentially sensitive server memory contents over the network. The flaw spans all four supported major versions across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks, producing a broad enterprise exposure surface. Microsoft has released patches for all affected version branches; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated network attacker with low privileges to disclose sensitive server-side information. The flaw spans SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release servicing branches, representing a broad exposure across enterprise database deployments. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server 2017 through 2025 allows network-authenticated, low-privilege database users to disclose sensitive server-side memory contents. The flaw (CWE-125) is reachable over the network with only a valid database account, requiring no user interaction, and affects all currently supported SQL Server release tracks - both Cumulative Update and General Distribution Release channels. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in Microsoft SQL Server exposes adjacent memory contents to authenticated low-privileged network attackers across SQL Server versions 2017 through 2025. The vulnerability spans both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches, making patch management across heterogeneous SQL Server estates non-trivial. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2025 allows an authenticated network attacker to disclose sensitive in-memory information. Affected versions span both the CU8 cumulative-update branch (below 17.0.4085.5) and the GDR branch (below 17.0.1135.8). No public exploit or CISA KEV listing exists at time of analysis; Microsoft has released patches for both branches.
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server (versions 2017 through 2025) allows a low-privileged authenticated attacker to disclose sensitive information over the network by triggering a memory read beyond an allocated buffer boundary. The CVSS vector confirms network-accessible exploitation requiring only low-privilege credentials (PR:L), with no user interaction needed, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected servicing branches.
Out-of-bounds memory read in Microsoft SQL Server exposes sensitive server-side data to authenticated network attackers. The flaw (CWE-125) spans four major SQL Server release lines - 2017 through 2025 - in both GDR and Cumulative Update servicing tracks, making it broadly present across enterprise environments. An attacker holding low-privilege SQL Server credentials can exploit this to read memory contents beyond an intended buffer boundary, achieving high confidentiality impact without any user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft SQL Server enables an authenticated, network-adjacent attacker to disclose sensitive in-process memory contents. Affecting SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks, exploitation requires valid database credentials but no elevated privileges. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server allows a low-privileged, authenticated attacker to remotely disclose sensitive memory contents over a network. Affected builds span SQL Server 2017 through 2025 across both Cumulative Update and GDR servicing branches. With a CVSS 6.5 and C:H, successful exploitation could expose confidential server-side data; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privileged attacker to disclose sensitive server memory contents over the network. The flaw (CWE-125) resides in the SQL Server engine and is reachable via crafted network queries, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a network-connected low-privilege authenticated attacker to read sensitive data from SQL Server memory. The flaw (CWE-908) arises when the engine allocates and uses memory without proper initialization, potentially exposing contents from adjacent queries, sessions, or internal data structures. Microsoft has released patches across all affected Cumulative Update and GDR servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient audit logging in Microsoft SQL Server 2022 and 2025 allows a low-privileged authenticated attacker to bypass a security control over the network, resulting in high-confidentiality data access without a corresponding audit trail. Affected versions span both the GDR and Cumulative Update branches of SQL Server 2022 (pre-16.0.4275.2 / pre-16.0.1200.5) and SQL Server 2025 (pre-17.0.4085.5 / pre-17.0.1135.8). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Remote code execution is possible in Windows Remote Desktop Services via a use-after-free memory corruption flaw, affecting Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. An authenticated, network-connected attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system. CVSS 7.5 (AV:N/AC:H/PR:L) reflects that exploitation requires low-privilege authentication and high attack complexity, making opportunistic mass exploitation less likely; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Arbitrary file system read in Adobe ColdFusion 2023 (Update ≤23) and ColdFusion 2025 (Update ≤12) exposes sensitive files and directories outside the intended access scope to unauthenticated remote attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation requiring no credentials and no user interaction, with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity raises concern for rapid weaponization.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released corrective patches across all affected build branches.