Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. While direct impact is limited to information disclosure, this class of kernel pointer leak is routinely used to defeat KASLR as a prerequisite step in local kernel privilege-escalation chains; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode driver's authentication mechanism and issue unlimited memory allocation requests, saturating available system memory. The vulnerability is classified CWE-770 (Allocation of Resources Without Limits or Throttling) and is scoped to local availability impact only - no confidentiality or integrity loss occurs. No public exploit code or active exploitation has been identified at time of analysis.
Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly invoke the driver's System Management Interrupt (SMI) triggering capability, a function classified under CWE-749 as an exposed dangerous method. Repeatedly calling this function forces the CPU into System Management Mode in rapid succession, producing brief but repeatable system stalls that can escalate into a denial-of-service condition. No public exploit code exists and the vulnerability is not listed in CISA KEV, but ASUS has released a security advisory with an available fix.
Missing session authentication on vault unlock and recovery endpoints in moltis-org/moltis allows a remote unauthenticated attacker to attempt vault unsealing using only a stolen vault password or recovery key phrase, bypassing the intended dual-layer session-plus-credential security model. All versions through 20260818.10 are affected; the `/api/auth/*` path was globally allowlisted in `is_public_path()`, which caused the `AuthSession` middleware extractor to be silently skipped for both `vault_unlock_handler` and `vault_recovery_handler`. A proof-of-concept exists and vendor-released fix version 20260819.01 is available.
The Okta Hyperdrive Agent plugin improperly implements SAML authentication verification - when an organization's policy exempts a given user from MFA, the agent returns a success response containing only a bare boolean flag rather than a cryptographically signed SAML assertion. The relying application receives an authentication verdict it cannot verify, creating an exploitable integrity gap in the SSO trust chain. Affected versions span 1.2.0 through below 1.5.2; Okta has released a patch and no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office PowerPoint exposes process memory contents to a local attacker when a victim opens a specially crafted presentation file. Affected across a wide range of Office versions - PowerPoint 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365/Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor patch is available.
Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Out-of-bounds memory read in Microsoft Excel exposes potentially sensitive in-process memory contents when a user opens a specially crafted workbook. Affects a wide range of Office versions including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office for Mac editions. SSVC assessment rates exploitation as none with non-automatable attack delivery, and Microsoft has released patches addressing all affected branches. No public exploit or CISA KEV listing exists at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Excel allows a local attacker to disclose potentially sensitive process memory when a user opens a crafted Excel workbook. The flaw spans a broad range of Office versions from 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise and Mac variants, making the affected footprint very large. No public exploit code or CISA KEV listing has been identified; exploitation depends on social engineering to deliver a malicious file to the local system.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Information disclosure in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, allowing a locally authenticated low-privileged attacker to read sensitive system information that should remain within an authorized control sphere. The vulnerability (CWE-497) requires no user interaction and is limited to local attack vectors with no integrity or availability impact. Microsoft has released patches addressing all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Unauthenticated remote access to a backup archive file (`example.7z`) in ningzichun's Student Management System exposes sensitive application data to any network attacker. The Backup Handler component stores or serves this archive at a predictable location without access control, enabling direct retrieval of backup contents that may include database dumps, student records, or application credentials. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the project maintainer has not responded; no patched release exists.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20090) allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint pages, enabling spoofing attacks against users who view the compromised content. The CVSS vector (PR:L/UI:R/C:H/I:H) indicates victim interaction is required and that impact may extend to session token exposure or impersonation within the SharePoint context. No public exploit code has been confirmed and no active exploitation is listed in CISA KEV at time of analysis.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.