Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft Windows PDF rendering affects a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds, where an integer overflow while parsing a crafted PDF wraps a size calculation and triggers a heap-based buffer overflow (CWE-122). An unauthenticated attacker who delivers a malicious PDF over the network can execute arbitrary code with the privileges of the rendering process. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Remote code execution in Microsoft Dynamics 365 on-premises version 9.1 (prior to build 9.1.0046.0006) is achievable by an authenticated low-privileged attacker via deserialization of untrusted data over the network. The CWE-502 flaw allows crafted serialized objects to be processed without adequate validation, yielding full confidentiality, integrity, and availability compromise of the affected server. No public exploit code has been identified at time of analysis; Microsoft has released a patch addressing this vulnerability.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to execute arbitrary code on the database server host. Both the GDR and CU 26 servicing branches of SQL Server 2022 are affected, with Microsoft having released fixed builds in both channels. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and full network reachability make this a high-priority patching target for any organization running SQL Server 2022.
Remote code execution in Microsoft Exchange Server allows a low-privileged authenticated network attacker to execute arbitrary code by supplying externally controlled file paths (CWE-73). Affected are Exchange Server 2016 CU23, 2019 CU14/CU15, and the Subscription Edition RTM release lines, all prior to their respective July 2026 patch levels. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft's history with Exchange RCE vulnerabilities makes this a high-priority remediation target for any organization running on-premises Exchange.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in Microsoft SQL Server 2022 and 2025 allows a low-privileged, network-authenticated attacker to achieve remote code execution against the database engine. The vulnerability is reachable over the network with low complexity, requiring only a valid SQL Server login - no elevated privileges or user interaction. Patch has been released by Microsoft across both GDR and Cumulative Update servicing branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code on a victim's system when the victim opens a specially crafted Office document. Multiple product lines are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and Mac variants of each. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this is a high-severity code execution path; no public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Microsoft SQL Server 2017 and 2019 enables unauthenticated network attackers to execute arbitrary code on the database host with high impact across confidentiality, integrity, and availability. The flaw (CWE-122) is reachable without credentials over the network, though user interaction is required per the vendor CVSS vector (UI:R), placing the CVSS base score at 8.8. A vendor patch is available, and no public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges over a network connection. Affected versions span all active servicing branches of SQL Server 2017, 2019, 2022, and 2025 - including both GDR and Cumulative Update channels - making this a broad-surface enterprise concern. Vendor-released patches are available across all affected branches; no public exploit code or CISA KEV listing identified at time of analysis.
Privilege escalation via permissive cross-domain policy in the Azure Arc SQL Server Extension (versions < 1.1.3518.465) allows a remote unauthenticated attacker to leverage a victim's authenticated session to make cross-origin API calls and elevate privileges over the network. The flaw stems from an overly permissive CORS/cross-domain policy that trusts untrusted external domains, enabling attacker-controlled pages to issue privileged requests on behalf of a visiting authenticated user. No public exploit has been identified at time of analysis, but a vendor-released patch is available.
Privilege escalation in Microsoft SQL Server 2017 through 2025 allows any low-privileged authenticated database user to exploit improper symbolic link resolution during SQL Server file operations to gain high-level control over the host system across the network. The root cause is CWE-59 (link following): SQL Server resolves file system links without validating the resolved path, enabling a low-privilege login to redirect the high-privilege SQL Server service account into accessing or overwriting attacker-controlled targets. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version scope - spanning all major SQL Server releases still in mainstream support - make patching an immediate operational priority.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network attacker to execute arbitrary code on the database host. The vulnerability (CWE-122) resides in a network-reachable code path, requiring only valid SQL Server credentials - no elevated database roles or special configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the full CIA impact and low attack complexity make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server 2025 is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow in the database engine. The flaw (CWE-122) affects both the GDR and CU8 cumulative update branches of SQL Server 2025, requires only a low-privilege database login (PR:L per CVSS), and yields full confidentiality, integrity, and availability impact upon successful exploitation. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) triggered over a network connection by a low-privileged authenticated attacker. The vulnerability spans all major in-support release branches including GDR and Cumulative Update servicing tracks, with fixed builds identified across eight distinct release configurations. No active exploitation has been confirmed in CISA KEV, but the low attack complexity and broad version coverage make this a high-priority patch target for any organization running SQL Server on the network perimeter or in multi-tenant environments.
SQL injection in Microsoft SQL Server (versions 2017 through 2025) enables a network-authenticated low-privilege attacker to escalate privileges within the database engine. The flaw exists across all current servicing tracks - both cumulative update (CU) and general distribution release (GDR) branches - for SQL Server 2017, 2019, 2022, and 2025. No public exploit code or active exploitation has been identified at time of analysis, but vendor-released patches are available for all affected versions.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release (GDR) servicing tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft SQL Server (versions 2017 through 2025) enables any authenticated network attacker holding a low-privileged SQL Server account to achieve full remote code execution on the database host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires no user interaction and is low-complexity once a valid login is held, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; Microsoft has released patches across all affected major release branches including both CU and GDR servicing tracks.
Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a heap-based buffer overflow in the database engine. An authenticated low-privileged attacker reachable over the network can exploit this flaw to achieve full system compromise - confidentiality, integrity, and availability all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Remote code execution in Microsoft SQL Server 2025 is achievable by low-privileged authenticated attackers over the network via a heap-based buffer overflow (CWE-122). Both the GDR (General Distribution Release) and CU8 (Cumulative Update 8) servicing tracks for SQL Server 2025 are affected, spanning version ranges 17.0.1050.2-17.0.1135.8 and 17.0.0.0-17.0.4085.5 respectively. Vendor patches are available through the Microsoft Security Response Center; no public exploit code or active exploitation has been identified at the time of analysis.
Privilege escalation in Microsoft SQL Server (versions 2017, 2019, 2022, and 2025) allows a low-privileged authenticated user to elevate their database permissions to a higher role over the network via CWE-269 improper privilege management. With a CVSS 8.8 score and vector AV:N/AC:L/PR:L, the flaw requires only a valid SQL Server login - no attack complexity, no user interaction - and yields full confidentiality, integrity, and availability impact on the database instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the near-zero exploitation prerequisites within a widely deployed enterprise platform make urgent patching essential.
Remote code execution in Microsoft SQL Server 2017 and 2019 is enabled by an integer overflow that precipitates a heap-based buffer overflow (CWE-122), allowing an unauthenticated network attacker to execute arbitrary code on the database host. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low attack complexity and no required privileges, though some user interaction is required, moderating fully automated exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected servicing branches.
Privilege escalation in Microsoft SQL Server (2017 through 2025) allows a low-privileged authenticated network attacker to gain full administrative control via improper access control enforcement. The vulnerability spans four major SQL Server release trains - 2017, 2019, 2022, and 2025 - including both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit code has been identified at time of analysis, but the low attack complexity and broad affected surface across enterprise SQL Server deployments make this a meaningful priority for patching.
Privilege escalation in Microsoft SQL Server allows a network-authenticated low-privileged attacker to elevate to higher database roles via a weak authentication mechanism (CWE-1390). Affected releases span SQL Server 2017 through 2025 across both General Distribution Release (GDR) and Cumulative Update (CU) servicing branches. Microsoft has released patched builds for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server allows a low-privileged, authenticated network attacker to elevate access rights and achieve full control over database confidentiality, integrity, and availability. The root cause is CWE-1220 (Insufficient Granularity of Access Control), meaning SQL Server fails to enforce sufficiently fine-grained permission boundaries between privilege tiers, permitting lateral movement to higher roles without authorization. All active major servicing branches are affected - SQL Server 2017, 2019, 2022, and 2025 - and Microsoft has released patches across both Cumulative Update and GDR servicing tracks. No public exploit or active exploitation (KEV) has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to elevate to higher database or system-level permissions over a standard network connection. The flaw, rooted in CWE-284 (Improper Access Control), requires only a valid low-privilege SQL Server login and network reachability to the instance - no special configuration or user interaction is needed. Microsoft has released patches across all affected cumulative update and GDR servicing branches; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation via SQL injection in Microsoft SQL Server affects versions 2017 through 2025, allowing an authenticated low-privileged network user to gain elevated database privileges. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), and spans both Cumulative Update and General Distribution Release (GDR) servicing branches across all major SQL Server generations. Patch is available from Microsoft; no public exploit code or active exploitation (CISA KEV) confirmed at time of analysis.
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to circumvent a security feature via a user-controlled key (CWE-639), with user interaction required to trigger exploitation. The CVSS 8.8 score reflects full impact across confidentiality, integrity, and availability (C:H/I:H/A:H), indicating potential complete compromise of the affected VS Code instance. A vendor-released patch is available in version 1.136.2 per the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) allows an authenticated remote attacker to run arbitrary code on the server by abusing a missing authorization check (CWE-862). Because a low-privileged account is sufficient (CVSS:3.1 PR:L) and the flaw escapes its security scope (S:C) to fully compromise the host, Ivanti rated it 9.9 critical. No public exploit identified at time of analysis and it is not on CISA KEV, but this is one of a cluster of critical ITSM RCEs Ivanti disclosed in the same advisory.
Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) lets an authenticated attacker run arbitrary code on the server by reaching a function that fails to enforce authorization (CWE-862). Any low-privileged account is sufficient, and the CVSS 9.9 scope-change rating reflects that successful exploitation compromises confidentiality, integrity, and availability of the server and downstream components. No public exploit has been identified at time of analysis, but the vendor-issued advisory and 9.9 severity make this a top-priority patch item.
Remote authenticated arbitrary code execution affects Ivanti Neurons for ITSM before 2026.2, where a missing authorization check (CWE-862) lets a low-privileged authenticated user reach functionality that executes code on the server. Rated CVSS 9.9 with a scope-change vector, it grants full confidentiality, integrity, and availability compromise of the ITSM host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (2026.2) is available.
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache Camel - Hawtio 4) lets any authenticated user holding namespace 'edit' rights obtain an OpenShift Service-CA-signed client certificate with an attacker-chosen Subject CN. Because the operator reads the Service CA private signing key and mints certificates using a CN supplied in a namespaced Hawtio custom resource - and its ClusterRole aggregates Hawtio CR permissions into the standard edit/admin roles - a low-privileged tenant can forge a certificate that impersonates arbitrary in-cluster service identities (e.g. Jolokia agents) to any component trusting the Service CA for client authentication. No public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.9 rating and low attack barrier make it a high-priority patching target.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated network attacker with low-level database credentials to achieve full remote code execution on the SQL Server host. The CVSS 8.8 (PR:L) rating reflects that any valid SQL Server login - not just a DBA - can trigger the overflow, making this dangerous in environments with broad user bases or shared credentials. No public exploit has been identified at time of analysis, but patches are available from Microsoft across all affected major versions.
Heap-based buffer overflow in Microsoft SQL Server (2017 through 2025) enables network-reachable, low-privileged authenticated attackers to execute arbitrary code on the database server. With CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), exploitation requires only a valid database login - no administrative privileges or user interaction - making this a credible lateral-movement vector in environments with reachable SQL Server instances. Vendor patches are available across all affected GDR and CU servicing tracks; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2025 allows a network-authenticated low-privileged attacker to achieve remote code execution against affected database instances. Both the GDR servicing branch (below 17.0.1135.8) and the CU8 cumulative update branch (below 17.0.4085.5) are vulnerable. Microsoft has released patches via MSRC; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server enables a low-privileged authenticated attacker to remotely execute arbitrary code on the database server. All major active SQL Server branches are affected - 2017, 2019, 2022, and the newly released 2025 edition - across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in Microsoft SQL Server enables a network-authenticated low-privileged attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. Affected versions span all actively serviced SQL Server releases from 2017 through 2025, across both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication barrier (any valid SQL Server login) and network accessibility make this a high-priority patching target in enterprise environments.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to escalate privileges to full control of the database instance. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
SQL injection in Movie_Recommend v1.0.0 lets remote unauthenticated attackers read arbitrary database contents by injecting crafted SQL through the 'sort' parameter of the /loadingmore endpoint. A public write-up with exploitation details exists on GitHub, but the flaw is not in CISA KEV and no active exploitation is reported. Despite a 9.8 CVSS, the described impact is limited to database disclosure, making the integrity/availability portion of that score questionable.
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, combining a missing authorization check with unsafe reflection that lets externally-controlled input select and instantiate arbitrary classes. Any attacker able to reach an exposed Nutch Server endpoint can invoke functionality and drive class loading without credentials, yielding full compromise of the host. No public exploit identified at time of analysis and EPSS is low (0.36%), but the CVSS 9.8 rating and trivial network vector make exposed instances high priority.