Remote unauthenticated attackers can bypass authentication by spoofing in Ivanti Connect Secure versions before 25.1.3.0 and execute arbitrary commands with full system compromise. This vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists. Ivanti Connect Secure 22.7R2.14 and prior are explicitly not affected, and the vendor-released patch is version 25.1.3.0 or later.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an unauthenticated attacker to execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration that passes insufficient regex validation; the defect is tracked as CWE-190 (integer overflow) and the vendor scores it 10.0 with scope change (S:C). Publicly available exploit code exists, referenced through HackerOne reports cited in the CVE record, but there is no CISA KEV entry and no confirmed active exploitation at time of analysis. Our independent assessment retains the same impact (C:H/I:H/A:H) but raises attack complexity to AC:H, because the vendor states the regex-validation path is reached by an unauthenticated user only 'under certain conditions' that are not detailed publicly and should be confirmed with GitLab; patched instances (19.4.2, 19.3.5, 19.2.8 or later) are not affected.
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) component of .NET, specifically runtimes 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1, as well as Visual Studio 2022 17.14 and Visual Studio 2026 18.10 installations that carry the vulnerable runtime. An unauthenticated attacker can deliver crafted content that, when a victim interacts with an XPS document whose synthetic hyperlinks are exposed through UI Automation, bypasses the application's restrictive navigation checks and reaches attacker-controlled content, leading to code execution in the context of the running application; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms high confidentiality, integrity, and availability impact but explicitly requires user interaction. Vendor patches are available (runtime fixes 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2), and no public exploit code was identified at time of analysis despite the network-reachable attack path.
OS command injection in Wavlink WL-WN592AX6 firmware 250422 allows unauthenticated network attackers to execute arbitrary shell commands through the wmapd daemon's system function when they can reach the device management surface. The flaw is tracked as CVE-2026-109110 (CWE-78) with a 9.3 CVSS v4.0 score, and publicly available exploit code exists, though no confirmed active exploitation is indicated in the supplied data. Exploitation requires network access to the affected management interface; because this consumer range extender is typically LAN-facing, Internet exposure depends on WAN exposure or an attacker on the local/adjacent network.
Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.
Remote code execution in Microsoft's Windows Presentation Foundation (WPF) component of .NET allows an unauthenticated remote attacker to run arbitrary code on a Windows host, but only when a WPF-based application loads or renders attacker-supplied XAML or XPS content and the victim opens or processes that malicious document (CVSS PR:N/UI:R). The vulnerable component is Microsoft.WindowsDesktop.App.Runtime, affecting .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), .NET Framework 3.5/4.6.2-4.8.1, Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4) on Windows only. Publicly available exploit code exists (a public gist is referenced), though CISA SSVC records Exploitation as none and CISA KEV does not list this CVE; CISA's SSVC decision also rates the issue as not automatable, so mass opportunistic scanning is unlikely and practical risk concentrates on environments whose WPF applications consume untrusted markup. Signals are moderately strong but not uniformly alarming: high technical impact (total via SSVC) is tempered by the required user interaction and the absence of a server-side, zero-click remote path in default configurations.
Command injection in the Wavlink WL-WN530BE1-A wireless router (firmware 251117) allows an authenticated, low-privileged user of the web management interface to execute arbitrary shell commands on the device via the 'Type' parameter of /cgi-bin/uploadVpn.cgi, which is passed unsanitized into a popen() call. Because the flaw requires only a valid session (CVSS PR:L) with no user interaction (UI:N) and generally only LAN-side reachability to the management interface, the practical barrier is low: SOHO devices frequently ship with default or weak admin credentials. Publicly available exploit code exists (a published GitHub gist), but no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch version is identified in the available data.
Unauthenticated remote attackers can crash yt-dlp-web-ui 4.0.0 and earlier by sending a single JSON-RPC request to the default Service.Formats method, where a crafted url value such as '--version' is passed to the underlying yt-dlp process and produces unexpected output that fails JSON parsing, leading to a NULL pointer dereference and an unrecovered panic that terminates the server process. No credentials, user interaction, or special configuration are required - the only precondition is network reachability of the JSON-RPC interface - and publicly available exploit code exists, so any instance bound to a routable interface or exposed through a reverse proxy is trivially and repeatedly deniable. The impact is confined to availability: there is no data exposure, integrity loss, or code execution.
Stored cross-site scripting in GitLab CE/EE (affected ranges 19.1 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1) lets an authenticated user with repository write access embed a crafted file whose syntax-highlighted output is rendered with unsanitized HTML attributes, executing arbitrary JavaScript in the browser session of any other user who views it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects that the attacker must be authenticated (PR:L) and that a second user must render the malicious content (UI:R), but that successful execution crosses a trust boundary (S:C) with high confidentiality and integrity impact, including potential theft of session tokens or actions taken as the victim. Exploitation requires publicly available exploit code exists, with a HackerOne report and the upstream work item publicly linked; CISA KEV status was not indicated in the supplied intelligence, so this should be treated as a high-priority authenticated stored XSS rather than a confirmed actively exploited campaign. The affected surface is bounded by the requirement for repository control plus a victim viewing the highlighted file, so unauthenticated or pure drive-by exploitation is not possible.
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
Improper verification of a cryptographic firmware signature in the D-Link DCS-930L (firmware B1.08B4) allows a remote attacker to supply a crafted firmware image that the device accepts and flashes, undermining the integrity of the bootloader recovery process. The flaw resides in the mpfd_decode function within bootloader_region.bin, part of the device's Emergency HTTP Recovery Server, which is normally reachable only when the camera is in firmware recovery/bootloader mode rather than in its default running state; exploitation therefore generally requires the device to be in (or forced into) recovery mode and network-reachable, plus the passive user interaction (UI:P) specified by the CVSS 4.0 vector. Publicly available exploit code exists and the input assigns a critical CVSS 4.0 base score of 9.4, but there is no confirmed active exploitation (not listed in CISA KEV) and the E:P metric indicates only Proof-of-Concept maturity.
Stack-based buffer overflow in the TRENDnet TEW-432BRP (firmware 3.10B20) web management interface lets an attacker with a valid low-privilege session crash or execute code on the device by sending an overlong 'Name' parameter to the /goform/formTcpipSetup handler. Publicly available exploit code exists, so risk is elevated wherever the router's management interface is reachable from an untrusted network or is protected only by default or weak credentials; impact is negligible where management access is confined to a trusted LAN. The device reached end-of-life in 2011 and the vendor has confirmed it has no way to test or patch the issue, meaning no vendor fix will be issued and replacement is the only complete remediation. This is not confirmed as actively exploited (CISA KEV), but the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact when the authentication prerequisite is met.
Privilege escalation and security-feature bypass in Microsoft ASP.NET Core's Blazor authorization stack lets an authenticated remote user defeat an application's [Authorize] decision and reach content or operations their role should not permit. The flaw is a race condition in the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component, where a stale asynchronous authorization result can be applied after a navigation or an authorization-state change, so the current authorization decision is silently overwritten by an earlier one. Only Blazor applications that use AuthorizeRouteView for route-level authorization are in scope; ASP.NET Core deployments that do not use Blazor component-level authorization are unaffected. Exploitation is non-deterministic (CVSS AC:H) and requires the attacker to already hold a valid authenticated session (PR:L), and publicly available exploit code exists as a published proof-of-concept gist, but CISA SSVC rates exploitation as none and the issue is not automatable. Vendor patches are available across all supported ASP.NET Core release trains.
An authenticated user holding only the Developer role can run CI/CD pipelines on protected branches in GitLab CE/EE without authorization, because the downstream (multi-project/child) pipeline creation service failed to enforce proper permission checks (CWE-863). All versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, and exploitation is conditional: it requires a valid Developer account plus projects that combine downstream pipelines with protected-branch restrictions, which is why the independent assessment raises attack complexity to High even though the vendor rates the issue 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N). Publicly available exploit code exists in the form of a HackerOne report, but the provided data contains no confirmation of active exploitation and no KEV listing. Integrity impact is the dominant risk: unauthorized pipeline execution on a protected branch can inject or alter build, test, and deployment artifacts that the branch protection model was designed to shield.
Cache poisoning of raw repository file responses in GitLab CE/EE (all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) lets a low-privileged authenticated user supply crafted repository references so that cached raw-file content is served to other users. When a targeted victim's CI/CD pipeline subsequently fetches that poisoned raw file, the pipeline executes attacker-controlled content, potentially exposing protected environment variables. Publicly available exploit code exists (referenced via a HackerOne report), but the issue is not confirmed as actively exploited (no CISA KEV listing); exploitation is rated high complexity (AC:H), requires authentication (PR:L), and success depends on a victim pipeline actually pulling and running the poisoned content, making this a credible, high-priority issue rather than an emergency.
Improper cleanup of scheduled pipeline execution policy records in GitLab Enterprise Edition lets an authenticated user execute arbitrary CI/CD pipelines in a transferred project using the destination group's privileges. Affected releases are all EE versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Exploitation is conditional - the attacker needs a valid account, a project that has a configured scheduled pipeline execution policy, the project-transfer workflow, and user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7) - but publicly available exploit code exists per the referenced HackerOne report, and no CISA KEV entry has been recorded, so this is a moderate, conditional privilege-escalation risk rather than a mass-exploitation emergency.
Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.
Path traversal in YouTransfer (versions up to 0.0.7, 1.0.6, and 1.1.0) lets an attacker manipulate the /settings/template endpoint of the Template Rendering component to reach files outside the intended directory, yielding limited confidentiality, integrity, and availability impact (CWE-22). Publicly available exploit code exists, including a GitHub proof-of-concept; no public exploit activity has been confirmed beyond the POC, and the CVE is not reported as actively exploited. The vendor was contacted about the disclosure but did not respond, and no vendor patch is confirmed, so exposure is governed mainly by whether the /settings/template path is reachable and whether that administrative settings surface is protected by authentication in a given deployment.
Remote code execution in Microsoft QUIC (MsQuic) is possible for unauthenticated network attackers via a use-after-free (CWE-416), with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The independent assessment adjusts the attack complexity to High (AC:H), since exploitation requires a reachable QUIC/UDP endpoint running a service built on the MsQuic stack, such as an HTTP/3 listener on UDP 443 or an SMB-over-QUIC file server. No public exploit code has been identified at time of analysis, and weaponization demands precise heap manipulation to turn the memory corruption into code execution.
Unauthenticated remote code execution in Windows Message Queuing (MSMQ) Queue Manager affects systems where the optional MSMQ feature is installed and reachable. The use-after-free (CWE-416) in the Queue Manager allows an attacker to execute arbitrary code over the network without authentication, but the attack surface is significantly limited because MSMQ is not enabled by default and must be exposed on TCP port 1801 (or related ports). No public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Text Shaping engine (CWE-122) allows unauthenticated remote attackers to execute arbitrary code, carrying a critical CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity, and availability impact. Affected systems span an unusually wide footprint of Windows client and server releases - Windows 10 21H2/22H2 and 1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) - but only unpatched builds below the fixed versions catalogued by ENISA EUVD are exposed. Microsoft has released vendor patches through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; because the assessed vector asserts no authentication and no user interaction, defenders should confirm the UI:N rating against the MSRC advisory, since text-shaping code paths are normally reached only when attacker-supplied content is actually rendered.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Remote code execution in Microsoft QUIC (msquic) allows unauthenticated network attackers to execute arbitrary code via a heap-based buffer overflow (CWE-122). Per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, no authentication or user interaction is required, and the flaw carries full confidentiality, integrity, and availability impact (base score 9.8). Only hosts exposing a QUIC/HTTP-3 or SMB-over-QUIC listener over UDP (typically port 443) are affected, and successful exploitation depends on defeating standard heap and control-flow mitigations; no public exploit has been identified at time of analysis.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
Remote code execution is possible in the Microsoft PostScript Printer Driver, where a heap-based buffer overflow (CWE-122) lets an unauthenticated attacker who can deliver crafted PostScript print data over the network corrupt heap memory and execute arbitrary code in the context of the Windows Print Spooler. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required; every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected unless it has been updated to the fixed build listed by Microsoft. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis - SSVC records exploitation as 'none' - so the practical exposure is driven by whether the print/spooler service is reachable from untrusted networks.
Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.
Unauthenticated remote code execution is possible in the kernel-mode CCFFilter driver shipped with multiple supported Windows client and server releases, because a use-after-free (CWE-416) in that driver can be triggered by network traffic and leads to memory corruption in kernel space. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, no credentials or user interaction are required, and the SSVC assessment rates the attack as automatable with total technical impact. No public exploit code has been identified at time of analysis and it is not listed as confirmed actively exploited (CISA KEV); exploitation signals are mixed, with the main practical uncertainties being the undocumented network reachability of this filter driver and the memory-timing precision that a reliable kernel use-after-free generally demands. Microsoft has released vendor patches for the affected builds.
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Heap-based buffer overflow in the Windows Rich Text Edit Control (RichEdit) allows remote attackers to execute arbitrary code in the context of the rendering application when a victim processes attacker-supplied rich text, without any authentication prerequisite per the CVSS vector (AV:N/AC:L/PR:N). Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac are all listed as affected, so the exposure surface spans both the operating system and productivity applications that embed the control. Vendor patches are already available (MSRC advisory for CVE-2026-70096, EUVD-2026-99161), and no public exploit code or confirmed active exploitation has been identified at time of analysis - CISA's SSVC assessment records Exploitation: none while rating the flaw fully automatable with total technical impact, making pre-patch exposure the primary concern. Note that while the vendor vector marks UI:N, our independent assessment applies UI:R, because exploitation realistically requires the target to open or preview crafted rich text in a RichEdit-backed application, which constrains mass spray-and-pray campaigns.
Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Unauthenticated information disclosure in yt-dlp-web-ui through 4.0.0 lets remote attackers read server-side files by supplying a dash-prefixed value such as --load-info-json in the url parameter of the Service.Formats JSON-RPC method, causing the underlying yt-dlp process to load an attacker-chosen JSON file whose parsed contents are reflected back in the RPC response. Publicly available exploit code exists, including a published security advisory with reproduction details, though there is no CISA KEV confirmation of active exploitation; the CVSS 4.0 base score is 6.9, while a CVSS 3.1 scoring of the same vector yields 5.3 (Medium) because impact is confined to confidentiality. Any network-reachable instance at or below version 4.0.0 is affected with no authentication, user interaction, or non-default configuration required, so self-hosted instances bound only to localhost or a trusted LAN are materially lower risk than internet-exposed deployments.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Remote code execution in Microsoft Windows Local Security Authority Subsystem Service (LSASS) affects multiple Windows 10, Windows 11, and Windows Server builds, allowing an unauthenticated network attacker to trigger an out-of-bounds write that can lead to code execution with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and exploitation requires only network reachability to an exposed LSASS interface on an unpatched host. No public exploit was identified at time of analysis and CISA SSVC records Exploitation: none and Automatable: no, but the unauthenticated remote vector makes this a top-priority vulnerability to patch; Microsoft has released a vendor patch.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Remote code execution in Microsoft Windows Shell (CVE-2026-83782) lets an unauthenticated attacker trigger a heap-based buffer overflow and run arbitrary code, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - no privileges, no user interaction and no non-default configuration are required per the assessed vector. The flaw affects Windows client editions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Windows Server 2025, so essentially every supported and several legacy Windows builds are in scope until patched. No public exploit code identified at time of analysis, and CISA's SSVC assessment records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, meaning the urgency driver today is patch coverage rather than observed attacks. CISA KEV does not list this CVE, so there is no confirmation of active exploitation.
Use-after-free in the Windows Search component of Microsoft Windows allows unauthenticated remote attackers to elevate privileges, per a CVSS 3.1 score of 9.8. No public exploit code has been identified at time of analysis. However, the description's framing as privilege elevation-which typically requires a local foothold-conflicts with the network-unauthenticated vector; confirm exact preconditions via the MSRC advisory.
Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.