Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Privilege escalation on supported Windows 10, Windows 11, and Windows Server builds stems from a use-after-free in the Cloud Files Mini Filter Driver (cldflt.sys), the component that services OneDrive-style cloud placeholder files. An attacker who already holds local, authenticated access to the host (CVSS PR:L, AC:H) and can drive concurrent cloud-file operations may win a narrow race window (CWE-362) and corrupt driver memory, ultimately gaining SYSTEM-level code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is not confirmed actively exploited (CISA KEV) and no public exploit code was identified at time of analysis; the local foothold requirement, the timing-dependent nature of the race, and the need for repeated attempts keep realistic risk below the raw score. Vendor patches are available from Microsoft.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Local privilege escalation in the Windows Clipboard User Service allows an attacker who already holds a low-privileged, authenticated session on a Windows host to win a race condition on an improperly synchronized shared resource and elevate their privileges on that machine. Only local access is viable (AV:L, PR:L) with no user interaction required, and the timing-dependent nature of the flaw (AC:H, SSVC Automatable=no) means exploitation is non-deterministic and typically requires many repeated attempts rather than a reliable one-shot trigger. There is confirmed publicly documented vendor patching but no public exploit identified at time of analysis, and the race-condition reliability plus the prerequisite foothold make practical risk more moderate than the 7.0 severity score alone suggests.
Vifm file manager versions 0.8.1-beta through 0.14.4 reuse an already-existing IPC FIFO named vifm-ipc-vifm in the shared temporary directory without verifying who owns it, so a local attacker who plants a world-writable FIFO can feed it IPC packets containing -c and ! shell commands that then run with the victim's privileges. Reaching the flaw requires a multi-user host with a common temp directory, a local foothold on that host (PR:L), and a victim who subsequently starts vifm (UI:R passive interaction); the independent assessment rates this CVSS:3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.8 High), while the supplied CVSS 4.0 vector scores 7.0. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and no vendor-released patch has been identified, since the referenced source at v0.14.4 still contains the vulnerable FIFO handling.
Command injection in the VNote note-taking application before version 4.3.0 lets an attacker-controlled note filename execute arbitrary commands as the victim user on Linux and macOS, but only when the victim opens that note and has configured an external program whose arguments are command-capable, such as vim/gvim's -c option. The root cause is SessionConfig::ExternalProgram::fetchCommand, which wraps the note path in double quotes and hands the whole string to QProcess::start(const QString&), so a double quote inside a POSIX filename terminates the quoted path and appends attacker-chosen arguments to the configured program. The vendor fixed the issue in 4.3.0; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0) reflects full impact on confidentiality, integrity and availability once the narrow exploitation prerequisites are met.
Elevation of privilege in the Windows Connected Devices Platform Service (Cdpsvc) allows a local, low-privileged attacker to gain SYSTEM-level privileges by exploiting a double-free memory corruption issue. The flaw affects Windows 11 versions 23H2 through 26H2 and Windows Server 2025 (including Server Core) prior to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation has been identified, but exploitation requires high attack complexity due to a race condition.
Local privilege escalation in WSL2 allows an authenticated low-privileged user to gain elevated privileges by exploiting a time-of-check time-of-use race condition. Affected versions are 5.0.0.0 through 2.7.10, and a vendor patch is available. No public exploit code is identified, and the high attack complexity (requiring precise timing) makes reliable exploitation difficult, consistent with CISA SSVC marking it as not automatable.
Privilege escalation in the Windows DWM Core Library lets a locally authenticated attacker with only low-level privileges raise their rights on an affected host by triggering a use-after-free (CWE-416) in the Desktop Window Manager's core component. Successful exploitation is constrained by high attack complexity (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), meaning it depends on winning a race/timing window and arranging a specific memory layout, so it is expected to be unreliable per attempt rather than a guaranteed escalation. This is a post-access escalation path rather than a remote entry point: the attacker must already hold a standard/interactive foothold on an unpatched build, and no user interaction is required. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Bind Filter Driver (bflt.sys), a core kernel-mode component, allows an authenticated low-privileged attacker with existing code execution on a target host to escalate to SYSTEM-level privileges through a use-after-free condition (CWE-416). Exploitation is not trivial: the flaw is a race condition requiring precisely timed reclamation of a freed kernel object, reflected in the high attack-complexity rating of the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 7.0), and the attacker must already hold local access (AV:L, PR:L) - this is a post-compromise escalation primitive, not a remote entry vector. No public exploit code was identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but second-tier priority relative to actively exploited kernel flaws; it nonetheless affects default installations of Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core) until patched.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated low-privileged attacker to gain elevated code execution by triggering a use-after-free (CWE-416) in the service's memory handling. Affected versions include Windows 11 24H2 (10.0.26100.0 < 10.0.26100.9711), 25H2 (10.0.26200.0 < 10.0.26200.9711), 26H1 (10.0.28000.0 < 10.0.28000.3231), and 26H2 (10.0.26300.0 < 10.0.26300.9711). Exploitation requires the attacker to already possess authenticated local code execution (PR:L, AV:L) and to win a timing-dependent race (AC:H), making reliable exploitation non-trivial; no public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Kerberos allows an authenticated attacker who already holds low-privileged code execution on a Windows 11 26H1 host (builds 10.0.28000.0 up to but not including 10.0.28000.3231) to elevate to a higher integrity level, with high impact across confidentiality, integrity, and availability on the affected machine. The root cause is a use-after-free that must be triggered and won as a race, so the high attack complexity (AC:H) materially limits reliable exploitation; there is no remote vector and no victim user interaction is required. No public exploit identified at time of analysis, no exploitation has been observed (CISA SSVC records Exploitation: none, Automatable: no), and a vendor patch is available.
Local privilege escalation in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows an authenticated attacker who already holds a low-privileged foothold on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 to elevate to SYSTEM-level code execution by triggering a use-after-free (CWE-416) inside the service. Exploitation requires winning a race condition to reuse a freed memory object, which raises attack complexity and limits reliability, and there is no remote vector - this is a post-compromise escalation primitive rather than an initial-access flaw. No public exploit code has been identified and no active exploitation has been confirmed; Microsoft has released vendor patches for all affected branches.
Privilege escalation in the Windows Kernel lets an authenticated local attacker with low privileges trigger a timing-dependent use-after-free in kernel memory and, on success, execute code at a higher integrity level (SYSTEM) on the affected host. Only unpatched Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 builds are in scope, and the attacker must already hold a local foothold on the machine - there is no remote or network-facing path. CISA's SSVC assessment records no exploitation and no public exploit has been identified at time of analysis, but because the technical impact is rated total and a vendor patch is already shipping, the update should be treated as a routine-but-priority patch rather than an emergency.
Local privilege escalation in Windows Active Directory Certificate Services (AD CS) arises from a race condition (CWE-362) on a shared resource, letting an attacker who already holds a low-privileged, locally authenticated account on an AD CS host gain elevated privileges with high impact to confidentiality, integrity, and availability. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable and requires no victim interaction, but its high attack complexity means success depends on winning a narrow, timing-dependent race, so exploitation is non-deterministic and may need many attempts rather than being cleanly automatable - consistent with CISA's SSVC rating of exploitation 'none' and automatable 'no'. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Microsoft has shipped a vendor update, making patching the definitive fix.
Local privilege escalation in the Windows Security App allows an authenticated attacker with existing local access to elevate privileges to SYSTEM or administrative level via a use-after-free (CWE-416) memory corruption condition. Exploitation is rated CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring a local foothold and successful heap grooming or timing manipulation; no public exploit code has been identified at time of analysis, and Microsoft has released a patch (see advisory).
Improper restrictions on internal APIs and file paths in Siemens Industrial Edge deployments - the Industrial Edge Device Kits for arm64 and x86-64 from V1.5 through V1.28, Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413/LPE9433, SIMATIC IoT2050 variants and the SIMATIC IPC BX-21A/BX-39A/BX-59A, IPC127E, IPC227E, IPC227G, IPC427E and IPC847E edge devices - allow an authenticated remote user to reach internal endpoints and resources beyond their intended authorization and read sensitive internal information, which in the worst case can be leveraged to facilitate unauthorized access to the system. The vendor score is CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only, scope-changing information-disclosure issue; the independent assessment reproduces the same vector but rates the privilege requirement as PR:L, so treating any authenticated user as a potential attacker is the safer assumption pending Siemens clarification. Exploitation requires network reachability to the device's management/internal API surface plus valid credentials, which in typical OT architectures confines risk to segmented industrial networks; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
Out-of-bounds memory reads in Siemens Desigo PXC building-automation controllers (all versions >= V2.3) and Capital Embedded AR Classic (431-422 all versions; R20-11 versions before V2303) allow an unauthenticated, remote attacker who can reach the device's packet-processing/communication service to read memory outside the intended packet boundaries by sending a malformed packet. Per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), the impact is limited to low confidentiality loss - no integrity or availability impact, and no code execution - because the flaw is a pure out-of-bounds read (CWE-125). There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is governed by network exposure of these typically segmented OT/building-management interfaces.
Unauthenticated remote attackers can delete and rebuild the shared product search index in FJ-OMS oms-erp through PRE by calling the public /v1/goods/sku/es-test maintenance endpoint in the skyer-goods microservice, degrading search availability for all tenants. This missing authentication flaw (CWE-306) requires only network reachability to the exposed endpoint, with no credentials or user interaction needed. No public exploit identified at time of analysis; the impact is limited to search index availability and integrity, and the index can be restored via reload.
Unrestricted file upload in phpwcms up to and including 1.9.49 and 1.12.3 lets an unauthenticated remote attacker upload files with server-executable extensions (for example .phtml, .phar, .pht, or .cgi) through the cnt23 article content form, because the pre-patch 'Extension Check' relied only on a short blocklist that omitted these variants. The attack requires the site to actually expose a front-end article content form (cnt23) with file upload enabled; impact ranges from arbitrary file storage to remote code execution depending on server configuration, since the content/form/.htaccess rule that denies PHP execution is enforced by Apache but ignored by Nginx and other servers. No public exploit identified at time of analysis, and there is no KEV listing, though the vulnerability is remotely reachable without credentials. Vendor-released patches are available in versions 1.9.50 and 1.12.4.
Denial of service in the ConnectBot cbssh/sshlib SSH client library (all versions through 0.3.0) lets a malicious or compromised SSH server crash the client process by returning a small malformed packet whose inner length or element-count fields are far larger than the containing packet. The Kaitai Struct Java runtime allocates an array using the attacker-declared length before it notices the input is truncated, producing excessive allocation and an uncaught OutOfMemoryError that terminates the host application; a second, narrower path exists through malformed SSH-agent messages, but only when SSH agent forwarding is enabled. The vulnerable client must initiate a connection to the hostile server (user interaction), which is the main limiting factor; there is no confidentiality or integrity impact, no authentication is required on the general transport path (CVSS 4.0 vector PR:N, UI:A), and no public exploit code was identified at time of analysis. The issue is fixed in version 0.3.1 and is not confirmed as actively exploited (CISA KEV).
Authenticated path traversal in Wazuh Manager versions 4.1.1 up to (but not including) 4.14.8 lets an attacker who already holds the shared cluster key - effectively a compromised or attacker-controlled cluster worker - pass traversal sequences as a filename to the get_list_file helper and read arbitrary files readable by the wazuh service account, including client.keys and an ossec.conf that may itself contain the cluster key. The access vector is network-based but gated behind high privileges (CVSS 4.0 PR:H, assessed as CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so only multi-node clustered deployments where a worker node or the shared cluster key has been compromised are meaningfully exposed; single-node installs without cluster workers are not. There is no write, modify, or availability impact, and no public exploit identified at time of analysis - this is a moderate, authentication-gated information-disclosure issue rather than a drop-everything priority.
Razorpay IFSC Ruby gem through version 2.0.62 is affected by a server-side request forgery (SSRF) vulnerability. Unauthenticated remote attackers can supply a crafted IFSC code to IFSC.find or IFSC#get - such as a network-path reference (//evil.host) or an absolute URI - that Ruby's URI.join resolves as a new host, redirecting API requests to internal or attacker-chosen hosts and returning parsed response fields. Exploitation requires the consuming application to pass untrusted input directly to these methods; impact is limited to low confidentiality (CVSS 4.0 base 6.9) with no write or availability effect, and no public exploit has been identified at time of analysis.
FreeRDP's freerdp-proxy component (versions 3.17.1 up to but not including 3.32.0) can be induced to read heap memory out of bounds by a malicious or man-in-the-middle-controlled backend RDP server, which sends a DRDYNVC CREATE_REQUEST_PDU whose channel name is not NUL-terminated. The unbounded snprintf in DynvcTrackerHandleCreateBack then walks past the allocated buffer, leaking adjacent heap contents into proxy log output or crashing the process; only the proxy's own backend connection path is exposed, so environments that connect solely to fully trusted RDP servers are not practically at risk. No public exploit has been identified at time of analysis, EPSS is not elevated, and the issue is not listed in CISA KEV; impact is bounded to memory disclosure and denial of service rather than code execution.
Missing authorization checks in B3log Symphony (B3log's Java-based blog/community platform) through version 3.6.4 allow unauthenticated remote attackers to reach administrative routes and perform state-changing actions, including suppressing reports via /admin/report/ignore/{reportId}, deleting unused tags via /admin/tags/remove-unused, and granting points to arbitrary users via /admin/user/{userId}/init-point. The flaw is a code-level default in PermissionMidware.check, which treats any route lacking a permission.rule.url entry as permitted, so no authentication, user interaction, or special configuration is required - only network reachability to the Symphony instance (CVSS v3.1 base 6.9, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Impact is integrity-only, with no confidentiality or availability effect, and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in ThriveX-Server through 4.0 lets any remote attacker read non-public article content - including drafts and soft-deleted posts - from the public blog API. The GET /api/article and /api/article/{id} endpoints omit an authorization check on the publication state of the returned record, so an attacker can simply pass isDraft=true or isDel=true as query parameters, or walk sequential article IDs, to retrieve the full title, description and body of articles the operator never intended to publish. The issue requires no credentials, no user interaction and no special configuration (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, 6.9 Medium; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and there is no public exploit identified at time of analysis and no CISA KEV listing, though a public technical write-up of the disclosure exists and the vulnerable source lines are linked from the advisory.
Unauthenticated remote attackers can defeat the login throttling of the Wazuh Manager REST API in versions 4.0.0 through 4.14.7 by sending parallel requests to the authenticate and run_as endpoints, because each concurrent request evaluates the block check before earlier failures are counted, removing the max_login_attempts ceiling and enabling unlimited password guessing. This is a moderate-priority weakness rather than an outright compromise: it only removes the rate limit, so the attacker must still guess a valid credential, and practical risk is neutralized by strong unique API passwords, network segmentation or IP allow-listing of the API, or upgrading to 4.14.8. No public exploit code and no confirmed active exploitation were identified at time of analysis; vendor-released patch: 4.14.8.
Persistent command execution in Citrix UniconOS lets a locally authenticated low-privilege user plant commands that survive normal operation and execute in a privileged context, giving the attacker sustained access to data and code on the endpoint. The flaw affects UniconOS releases before 2607.2 CR and before 2603 LTSR CU2; it is not remotely exploitable and requires an existing foothold or valid low-privilege credentials on the device, with no user interaction needed. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a patch, making this a moderate-risk, locally-scoped issue rather than an urgent widespread threat.
Local privilege escalation in HYPR Passwordless on Windows (all releases before 11.3.3) allows an attacker holding existing low-privileged local access to manipulate a user-controlled key used in an authorization decision, bypassing access checks and reaching resources belonging to other or higher-privileged principals. The vulnerability is an insecure direct object reference (CWE-639) rated CVSS:4.0 base 6.9 (Medium) with a local vector (AV:L, PR:L, UI:N) and high confidentiality impact but only limited integrity and availability impact, meaning the practical worst case is unauthorized disclosure rather than full host takeover. No public exploit code has been identified at time of analysis, and HYPR has addressed the issue in version 11.3.3, so only unpatched installations remain exposed.
Denial of service in the OpenVPN Data Channel Offload driver for Windows (ovpn-dco-win) allows a local attacker to deadlock the kernel driver with a crafted write to the ovpn-dco device, leaving the host unresponsive and typically requiring a reboot to recover. Windows endpoints running ovpn-dco-win 0.6.5 through 1.3.5 or 2.4.0 through 2.8.7 are affected; the assessed vector (CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates no privileges are required from the local vantage point, though device-object access controls may in practice restrict who can reach the write path, and there is no confidentiality or integrity impact, no code execution, and no privilege gain. No public exploit code has been identified at time of analysis and the failure mode is availability-only, making this a modest-priority local DoS rather than a remote or wormable issue.
Memory exhaustion in Wazuh agents (versions 3.9.0 through 4.14.7) allows an attacker who already controls the Wazuh manager to OOM-kill wazuh-modulesd on every agent in a targeted group by pushing a small SCA policy containing deeply nested YAML aliases through the merged.mg group-configuration channel. The agent-side yaml2json_node parser performs uncontrolled alias expansion, so the tiny policy expands into a far larger in-memory structure and consumes the agent process's memory. Exploitation is gated on manager control (CVSS 4.0 base 6.9, AV:N/AC:L/PR:H/UI:N/VC:N/VI:N/VA:H) and the impact is availability-only - no confidentiality or integrity effect; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in Wazuh 4.14.8.
Authentication bypass in Hono 4.12.4 up to (but not including) 4.13.11 lets unauthenticated remote attackers read static files that are supposed to be gated by prefix-mounted middleware: a malformed, double percent-encoded path is matched by the router in its encoded form, so middleware mounted on the decoded prefix never runs while serveStatic still resolves and serves the underlying file. The impact is limited to confidentiality of the exposed static content (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - no integrity or availability effect), and only deployments that both use serveStatic and rely on prefix-based middleware for access control are meaningfully exposed. No public exploit identified at time of analysis, and the vendor-released fix is Hono 4.13.11.
Resource exhaustion in the Certificate Path Builder of wbond certvalidator 0.11.1 and earlier lets unauthenticated remote attackers degrade availability by supplying crafted X.509 certificate chains for validation, consuming excessive CPU and/or memory (CWE-400, availability-only impact). The flaw is only reachable where a deploying application feeds attacker-controlled certificates into the library - for example mutual-TLS client certificates, PKCS#7 or document-signature verification, or any workflow that validates externally supplied chains - and is not remotely reachable in applications that never process external certificates. No vendor-released patch is available (the vendor was contacted but did not respond), and no public exploit code has been identified at time of analysis; EPSS data was not provided.
Weak authentication in the Network Device Enrollment Service (NDES) component of Active Directory Certificate Services lets an authenticated, network-positioned attacker spoof the enrollment service and obtain or manipulate certificate enrollment data, with high confidentiality and integrity impact but no availability impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). Only Windows Server hosts on which the optional NDES role has been installed and exposed are affected - this is not a default Windows feature - and the high attack complexity means success depends on a specific condition outside the attacker's control rather than a single deterministic request. No public exploit code has been identified and the issue is not listed in CISA KEV, and a vendor patch is available from Microsoft.
Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.
Elevation of privilege in the Microsoft Bluetooth Driver affecting Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016, 2019, 2022 and 2025 stems from an out-of-bounds read (CWE-125) that a physically present attacker can trigger with no authentication and no user interaction, achieving high impact across confidentiality, integrity and availability (CVSS 6.8). The decisive constraint is the CVSS attack vector AV:P: exploitation requires physical or local hardware-level access to deliver crafted input to the Bluetooth stack, so the flaw is not remotely reachable and CISA's SSVC framework rates it as non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and KEV/EPSS signals do not indicate active exploitation; residual risk is concentrated in lost, stolen, unattended, or otherwise physically accessible endpoints rather than in network-exposed systems.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
Privilege escalation in the Windows Kernel allows an attacker with physical access to a Windows 11 version 26H1 device to elevate to SYSTEM-level privileges by supplying an untrusted pointer to a kernel routine. Only machines running Windows 11 26H1 builds from 10.0.28000.0 through 10.0.28000.3231 are affected, and the exploit requires hands-on interaction with the hardware (CVSS AV:P), with no authentication or user interaction needed once that access exists. Microsoft has shipped a fix in build 10.0.28000.3231; there is no public exploit code and no evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the EPSS-style urgency is tempered mainly by the physical-access prerequisite, which limits realistic exposure to lost, stolen, unattended, kiosk, or shared hardware rather than remote attack.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Port Driver (CWE-122) lets an attacker who can physically interact with a target machine corrupt kernel pool memory and elevate privileges, with high impact to confidentiality, integrity, and availability (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8). Unpatched Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core installations, are affected; no authentication or user interaction is required, but the attack depends absolutely on hands-on physical access, is not remotely reachable, and cannot be automated (SSVC Automatable=no, Exploitation=none). No public exploit identified at time of analysis, no confirmed active exploitation (not listed in CISA KEV), and a vendor patch is available.
Manifest and blob digest verification bypass in the CNCF Distribution registry client (all versions prior to 3.1.2) lets an attacker who controls the registry HTTP response - by operating a malicious or compromised registry, or by holding a TLS-intercepting man-in-the-middle position - substitute attacker-chosen manifest content even when the caller pinned the request by digest, with the forged Docker-Content-Digest header presented as the requested value. The flaw is unauthenticated from the client's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.8) and scopes out of the client because the bundled pull-through proxy (registry/proxy/proxymanifeststore.go) can cache and re-serve the substituted manifest to downstream consumers, making this a conditional supply-chain integrity issue rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.1.2.
Stored cross-site scripting in the WP Testimonials WordPress plugin (all versions through 1.4.13) lets an authenticated user holding the Author role or higher persist JavaScript inside testimonial content, which then executes in the browser of any user - including an administrator - who later views the rendered testimonials (assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The plugin not only fails to escape testimonial output but actively reverses WordPress's built-in HTML sanitization when rendering it, so the payload survives despite core protections, and exploitation needs no non-default settings. Impact is gated by the Author-level privilege requirement plus a victim subsequently loading the affected page, so single-author or single-admin sites with no untrusted accounts are materially less exposed; at time of analysis there is no CISA KEV entry and no public exploit code identified, and the flaw was reported to WPScan (tracked as EUVD-2026-98299).