Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.
Integer overflow in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privilege network attacker to crash the database service, causing a denial of service for all connected clients. The flaw (CWE-190) is triggered by crafted network input that induces an integer wraparound in SQL Server's processing logic, resulting in complete availability loss. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected versions.
Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) exposes an authorization bypass via user-controlled key manipulation (CWE-639), allowing any authenticated network user to tamper with Exchange objects outside their authorized scope. An attacker with low-privilege access can substitute a manipulated object key in requests to affect mailbox data, calendar entries, or other resources belonging to other users, achieving high integrity impact with no confidentiality or availability consequence. Microsoft has released patched versions for all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server exposes server memory to authenticated low-privileged network attackers, enabling information disclosure across SQL Server 2017 through 2025. The flaw (CWE-125) is reachable over the network without elevated privileges or user interaction, making it accessible to any valid SQL Server login. Microsoft has released patches across all affected servicing branches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Uninitialized memory exposure in Microsoft SQL Server 2017 through 2025 allows a network-authenticated low-privilege attacker to read sensitive server-side data. The root cause is CWE-908 (Use of Uninitialized Resource), where a memory region is accessed before initialization, potentially leaking residual contents from query buffers, session state, or internal structures. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available across all affected version branches.
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to read sensitive server memory contents over a network connection. The CWE-908 flaw affects all major SQL Server release branches - 2017, 2019, 2022, and 2025 - across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or active exploitation is documented at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 exposes server memory contents to authenticated low-privilege network attackers, enabling information disclosure without integrity or availability impact. The flaw (CWE-125) requires only a valid low-privilege database account and network access, making it accessible to any SQL login holder - including application service accounts - against unpatched instances. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected versions across four major SQL Server release families widens the attack surface considerably.
Out-of-bounds read (CWE-125) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to disclose potentially sensitive server memory contents. The flaw is exploitable over the network with low complexity and requires only a valid database login - no user interaction or elevated privileges are needed. Microsoft has released patches across all six affected servicing branches; no public exploit code or CISA KEV active exploitation has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Remote code execution in Microsoft SharePoint Server Subscription Edition is possible via a time-of-check time-of-use (TOCTOU) race condition exploitable by authenticated network attackers. The vulnerability, tracked as CWE-367, allows an attacker with at minimum standard SharePoint user credentials to trigger a race window during a file or resource state check, ultimately executing arbitrary code on the server. The CVSS vector (AV:N/AC:H/PR:L) reflects that exploitation requires winning a timing race, raising the bar above trivially automated attacks, but the full C:H/I:H/A:H impact means successful exploitation yields complete server compromise. No public exploit code or active exploitation has been identified at time of analysis.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows remote unauthenticated attackers to bypass access controls and read sensitive platform data, achieving a privilege-escalation effect without any user interaction. The flaw stems from CWE-863 (Incorrect Authorization), where authorization checks fail to enforce the correct permission boundaries, letting an unauthenticated network request access resources restricted to higher-privilege roles. No public exploit code has been identified at time of analysis, but the combination of PR:N and C:H on a major e-commerce platform makes this a meaningful exposure for confidential business and customer data.
Heap-based buffer overflow (CWE-122) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted document. The CVSS vector (AV:N/AC:H/PR:N/UI:R) confirms network-based delivery without attacker authentication, but exploitation requires high attack complexity and active user interaction - consistent with a maliciously crafted Office file that triggers a memory corruption condition in Office's document parsing subsystem. Affected builds span Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac-platform variants; patched build numbers are available for Windows-based SKUs per EUVD-2026-73290, while Mac SKU fix versions are not specified in available data.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. The CVSS vector (UI:R) indicates user interaction is required, consistent with a cross-origin attack pattern where a victim must visit an attacker-controlled page that triggers the malicious cross-origin request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver enables a local attacker already holding administrator-level privileges to execute arbitrary code with scope change - meaning successful exploitation can affect components beyond the vulnerable driver itself, most critically the Hyper-V hypervisor or co-hosted VMs. The flaw spans virtually all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Vendor-released patches are available via Microsoft MSRC; no public exploit identified at time of analysis.
SQL injection in AppNitro MachForm v30 exposes sensitive database contents to unauthenticated remote attackers via the ap_form_{id} parameter. An attacker can craft a malicious SQL statement targeting this parameter to read arbitrary data from the underlying database, including credentials, form submissions, and configuration data. No public exploit code exists in CISA KEV, though a GitHub repository specifically referencing this CVE (nabeelmkhan/CVE-2026-78837) and a PacketStorm entry suggest proof-of-concept material is publicly available; EPSS sits at 0.21% (11th percentile), indicating limited observed exploitation despite the accessible attack surface.
Improper input validation in the TopicRegion component of Apache ActiveMQ allows an authenticated broker client to forge the clientId field in a durable subscription removal request, causing the broker to delete a subscription belonging to a different, legitimate client. All ActiveMQ deployments in the 5.x line before 5.19.11 and the 6.x line before 6.3.2 are affected across all platforms. With EPSS at 0.20% and no active exploitation observed, real-world urgency is moderate, though the silent integrity impact on guaranteed-delivery messaging architectures makes prompt patching advisable.
Denial of service in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an unauthenticated attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet targeting the btm_acl_handle() function. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the Bluetooth stack's ACL connection handler, causing the firmware to exhaust resources or reach an unhandled state upon receipt of malformed input. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.17%, indicating low current threat activity.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
XML External Entity injection in Distribution Management v1.0.0's level-rule module allows unauthenticated remote attackers to read arbitrary server-side files, conduct server-side request forgery to map internal networks, and potentially launch attacks against internal services by supplying a crafted XML payload. The CVSS vector confirms full confidentiality impact with no authentication barrier, though EPSS at 0.16% (6th percentile) indicates low observed exploitation activity. A public researcher writeup with a proof-of-concept payload has been published on GitHub, confirming practical exploitability.
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.
Sensitive kernel memory is exposed to local non-privileged user processes through improper GPU memory processing operations in Arm's Valhall GPU Kernel Driver and 5th Gen GPU Architecture Kernel Driver. The flaw spans a wide driver revision range - Valhall from r29p0 through r55p0 and 5th Gen from r41p0 through r55p0 - covering Mali-G series and Immortalis GPU generations deployed across hundreds of millions of Android and embedded devices. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the kernel-level confidentiality impact and the OEM-dependent patch delivery path make timely remediation structurally difficult.
Privilege escalation in Okta Hyperdrive Integration Plugin (versions 1.2.0 through pre-1.5.2) stems from the plugin resolving a .NET assembly path via the current user's HKCU registry hive and loading it with Assembly.LoadFrom without any signature or integrity check. A local attacker with standard user privileges who can write to the relevant HKCU registry key can redirect the load path to a malicious DLL, which then executes within the host process or elevated installer context - achieving privilege escalation beyond the attacker's normal trust boundary. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Use-After-Free (CWE-416) in the Windows Routing and Remote Access Service enables an unauthenticated attacker positioned on an adjacent network to execute arbitrary code on affected Windows systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025 and Windows 10/11 client versions, making the exposure surface substantial in enterprise environments where RRAS is deployed as a VPN or routing endpoint. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H/A:H impact and adjacent-network unauthenticated attack path make it a high-priority patching target for organizations running RRAS-enabled servers.
Memory exhaustion in Windows Active Directory Domain Services enables unauthenticated remote attackers to crash or severely degrade the AD DS service by repeatedly triggering a memory leak (CWE-401), denying authentication and directory services to all domain-joined systems. Affected builds span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit has been identified at time of analysis, though the unauthenticated network vector (PR:N, AV:N) makes this a significant priority for enterprise environments where AD DS availability is business-critical.
Privilege escalation in Microsoft .NET's diagnostic runtime allows a network-reachable unauthenticated attacker - contingent on user interaction - to gain elevated privileges by supplying an externally controlled file path (CWE-73). The vulnerable component is Microsoft.Diagnostics.Runtime, embedded in Visual Studio 2026 (18.9.x) and Visual Studio 2022 (17.14.x), making developer workstations the primary target. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H and UI:R requirements meaningfully reduce practical exploitability despite the full C:H/I:H/A:H impact rating.
Out-of-bounds read (CWE-125) in the Windows Kerberos implementation enables unauthenticated remote denial of service across a broad swath of Microsoft Windows versions. An attacker who can send a crafted Kerberos request over the network can crash the Kerberos service, disrupting authentication for all domain-joined users and services on the affected host. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Windows Hello on Windows 10 and 11 allows an authorized local attacker to elevate privileges beyond their current security boundary by exploiting a race condition in a shared resource. The vulnerability requires high initial privileges and high attack complexity due to race timing constraints, but successful exploitation yields scope-changed full C:H/I:H/A:H impact - consistent with SYSTEM-level compromise. Microsoft has released cumulative updates for all affected Windows 10 and Windows 11 builds; no public exploit code has been identified at time of analysis.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Remote denial-of-service in the Windows TCP/IP kernel stack allows an unauthenticated network attacker to exhaust kernel memory by sending crafted packets that trigger a memory allocation without a corresponding release (CWE-401), ultimately crashing or severely degrading affected systems. Affected releases span Windows Server 2022 and 2025, as well as Windows 11 versions 23H2 through 26H1, all with fixed builds published in the Microsoft Security Response Center update guide. No public exploit has been identified at time of analysis, and this vulnerability has not appeared in the CISA KEV catalog; however, the zero-authentication, low-complexity network vector makes the affected Windows TCP/IP stack a credible target for disruptive attacks against any internet- or network-exposed Windows deployment.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows unauthenticated remote attackers to crash the IKE service and deny VPN/IPsec negotiation to legitimate users. Affected systems span Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. Microsoft has released patches via the Security Response Center update guide; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. Microsoft has released patched builds across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.