Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
An open redirect (CWE-601) in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated remote attacker to craft an AD FS sign-in URL whose redirect parameter points to an untrusted site, so a victim who clicks the link is bounced from the trusted federation endpoint to an attacker-controlled destination - spoofing the identity provider. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no credentials or privileges but must induce user interaction, and impact is confined to confidentiality/session or credential theft against the user rather than server compromise. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); Microsoft has released patched builds for the affected Windows Server and Windows 10 versions.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds authorized access to the DNS service (CVSS PR:L) disclose memory contents over the network, with no user interaction required (UI:N) and low attack complexity (AC:L). Impact is strictly confidentiality (C:H/I:N/A:N) - there is no code execution, data modification, or denial of service, and only Windows and Windows Server builds with the DNS Server role enabled are exposed. This is a genuine but moderate-priority issue rather than a top-tier emergency: CISA SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
An out-of-bounds read in the Windows Print Spooler lets an unauthenticated remote attacker disclose memory contents over the network, but only if a victim is first induced to interact with an attacker-controlled print resource or crafted spooler response. Microsoft rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is confined to confidentiality - there is no code execution, data modification, or denial of service. All supported Windows client and server builds are affected, including Server Core installations, yet no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which keeps real-world priority low-to-moderate; vendor patches are available and should be applied through normal patch cycles.
Information disclosure in Microsoft Excel allows remote unauthenticated attackers to read portions of process memory by convincing a victim to open a specially crafted Excel document. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and unpatched Microsoft 365 Apps for Enterprise; exploitation requires user interaction, and no public exploit code or active exploitation has been identified at time of analysis. Vendor patches are available.
A buffer over-read in Microsoft Excel's document-parsing code allows an unauthorized attacker to disclose information over a network when a victim opens a specially crafted spreadsheet. Affected builds are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft Office LTSC 2021 before 16.0.14334.20974; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) the attacker needs no authentication or privileges but must convince the user to open the malicious file, and the impact is limited to memory disclosure (no code execution or data modification). Exploitation status is not confirmed: CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided, so this is not treated as an emergency patch item - this is a moderate-severity information disclosure flaw (CVSS 6.5) rather than a top-priority emergency, though the vendor has released fixes.
Out-of-bounds read in Microsoft Excel (CVE-2026-88184) allows an unauthenticated remote attacker to disclose sensitive in-process memory by convincing a victim to open a specially crafted Excel document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office editions for macOS. No public exploit code or active exploitation has been identified per CISA SSVC (Exploitation: none), and a vendor patch is available; the primary mitigating factor is the required user interaction (UI:R), which prevents zero-click or service-based exploitation.
Security feature bypass in Microsoft PowerShell 7.x allows an attacker to defeat a built-in protective control in the affected runtime, with the integrity impact scored as high while confidentiality and availability are unaffected. The flaw affects PowerShell 7.4 before 7.4.21, 7.5 before 7.5.12, and 7.6 before 7.6.7, and exploitation requires a victim to interact with attacker-supplied content (CVSS UI:R), so it cannot be triggered silently or server-side without a human running the malicious input; no authentication or prior privileges are needed. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC records Exploitation: none), and a vendor patch is available, making this a moderate rather than high-urgency issue. Note that the vendor description does not name the specific security feature being bypassed, which limits defenders' ability to scope the issue to a particular configuration or execution mode.
Security feature bypass in Windows PowerShell allows an unauthenticated attacker to defeat a security check, but the victim must actively run or open attacker-supplied content (UI:R), so it is not a hands-off remote exploit. Impact is integrity-only (C:N/I:H/A:N, CVSS 6.5); Microsoft has released patches, CISA SSVC rates exploitation as none and automatable as no, and no public exploit code was identified at time of analysis.
Adjacent-network denial of service in the Windows Wi-Fi driver affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, where a crafted 802.11 frame reaching the wireless stack triggers an out-of-bounds read (CWE-125) that can crash the driver and render the wireless connection unavailable. Per the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no authentication and no user interaction are required, and unauthenticated attackers within Wi-Fi radio range - on the same wireless LAN, a shared hotspot, or a rogue access point - can reach the target, making this a moderate-severity availability issue rather than a remotely exploitable internet-facing one. No public exploit code has been identified at the time of analysis (CISA SSVC: Exploitation=none, Automatable=no), though the vendor has released patched builds, and the impact is confined to availability with no assessed data exposure or code execution.
Denial of service in Microsoft SQL Server 2022 and SQL Server 2025 allows an authenticated attacker with only low-privilege login rights to exhaust server resources over a network connection, rendering the database engine unresponsive to legitimate queries. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so impact is confined to availability with no confidentiality or integrity exposure, and CISA's SSVC assessment rates exploitation as none, automation as not automatable, and technical impact as partial. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available, making this a moderate-priority hardening item rather than an emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
A use-after-free memory corruption flaw in the Microsoft Windows DHCP Server service lets an attacker who already holds high privileges, and who can reach the DHCP service over the network, execute arbitrary code on the server. Only hosts actually running the DHCP Server role (Windows Server 2012 through 2025, plus Windows 10 1607/1809 builds where the role is enabled) are exposed; default non-DHCP installations are not. Exploitation is constrained by high attack complexity (AC:H) and the PR:H requirement, and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis, with CISA's SSVC decision framework rating exploitation as 'none' and automation as 'no' - though the technical impact is assessed as total once the memory race is won. Vendor patches are available, so remediation is straightforward for administrators who can schedule a reboot.
Missing authorization checks in the Windows WebDAV component allow an attacker who already holds valid low-privilege credentials to bypass a security feature over the network, affecting only integrity (no confidentiality or availability impact). Microsoft rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning exploitation is straightforward once an authenticated foothold exists but does not permit data theft or denial of service. Vendor fixes are available; at time of analysis there was no public exploit code and no confirmed active exploitation (not in CISA KEV).
Microsoft Defender platform builds earlier than 1.1.26090.9 resolve filesystem links without properly validating them, allowing an attacker who already holds a local, low-privileged account to plant a symbolic link, junction, or hard link that Defender's own file access then follows, disclosing the contents of a file the attacker could not otherwise read. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) confirms this is strictly local, requires prior authenticated access (PR:L), and results in confidentiality impact only, with no integrity or availability effect and no remote path. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped a fixed Defender platform build, making this a moderate-priority hardening item rather than an emergency patch.
Improper certificate validation in .NET 11's System.Net.Security component allows a remote, unauthenticated attacker to bypass mutual TLS authentication, because post-handshake TLS client authentication can fail to verify the client certificate. Only pre-release .NET 11 builds (11.0.0-preview.1 through 11.0.0-rc.1) running on Linux or macOS are affected, and exposure requires the application to use post-handshake mTLS client-certificate authentication with a server that is configured to require client certificates. No public exploit code has been identified at time of analysis, and remediation is available in .NET 11.0.0-rc.2, Visual Studio 2026 18.10.4, and Visual Studio 2022 17.14.42.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
A null pointer dereference in Microsoft Windows Hyper-V allows an attacker who already holds low-privileged local access to crash the hypervisor or its host, producing a denial-of-service condition. Only hosts with the Hyper-V role enabled are exposed, the vector is local-only, and impact is confined to availability with no confidentiality or integrity loss; affected builds span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations. Vendor patches are available for all listed builds, no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none, with no KEV listing.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
Authenticated users can crash Grafana OSS and Grafana Enterprise by sending requests with unbounded body sizes to the Prometheus rule conversion API endpoints, causing unbounded memory allocation that leads to out-of-memory conditions and server unavailability. The vulnerability is rated CVSS 6.5 (moderate) and requires a valid Grafana account (PR:L) with access to these endpoints; no special feature toggle is needed. No public exploit has been identified at time of analysis, and the impact is limited to availability-there is no path to data access or code execution.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
Information disclosure in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 lets an authenticated remote user retrieve sensitive server information when the restConnector-2.0 administrative feature is enabled. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the issue requires valid credentials against the management interface and results in confidentiality loss only, with no integrity or availability impact; because restConnector-2.0 is not part of a minimal default Liberty server, deployments that never enabled it are not exposed. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Incorrect authorization in Grafana 12.4 (OSS and Enterprise) allows an authenticated user or service account that holds only read-only access to Git Sync (provisioning) connections to rewrite those connections' configuration by sending requests to the connection's status subresource, which does not enforce the same authorization as the parent resource (CWE-863). Exploitation requires three things simultaneously: a valid low-privilege Grafana account, the affected 12.4 release, and the non-default experimental 'provisioning' feature toggle explicitly enabled - the vulnerable status subresource API does not exist otherwise, so anonymous or unprovisioned instances are not exposed. The impact is integrity-only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no data disclosure or service disruption, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service on unpatched Windows 10 and Windows 11 builds allows an authenticated low-privileged attacker to gain elevated privileges by exploiting a time-of-check time-of-use race condition. The vendor CVSS 3.1 base score is 6.5 Medium (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), while the independent assessment rates the race as high complexity (AC:H) because the attacker must reliably win a narrow timing window; SSVC lists Exploitation: none and Automatable: no. No public exploit code was identified at time of analysis, and vendor patches are available for the affected Windows 10 21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1/26H2 branches.
An out-of-bounds read in the ESP-IDF BlueDroid L2CAP configuration-option parser lets an unauthenticated Bluetooth BR/EDR peer within radio range send a malformed configuration request that reads past the end of the received packet, and under some runtime conditions limited adjacent Bluetooth stack memory can be echoed back in an outbound L2CAP Configuration Response. Only ESP32-class devices built with the BlueDroid host stack and Classic Bluetooth (BR/EDR) enabled are affected; builds using the NimBLE stack or with Classic Bluetooth disabled are not exposed. Assessed as CVSS 3.1 6.5 (Medium, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), with no public exploit identified at time of analysis and no confirmed active exploitation - a genuine but moderate-priority issue rather than an emergency, addressed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Sensitive information disclosure in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, and FortiManager allows an authenticated low-privileged user to extract data from the underlying database via SQL injection. Affected versions include FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 versions; FortiAnalyzer Cloud 7.6.2-7.6.4, 7.4.1-7.4.7, and 7.2.1-7.2.11; and FortiManager 7.6.0-7.6.4, 7.4.0-7.4.6, and all 7.2 versions. This is a moderate-priority vulnerability due to the authentication requirement, and no public exploit code has been identified at time of analysis.
Man-in-the-middle interception of traffic from the IBM WebSphere Application Server - Liberty administrative client (versions 17.0.0.3 through 26.0.0.9) can expose sensitive information, because the client does not properly validate TLS certificates (CWE-295). The flaw is rated CVSS 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N): no authentication or user interaction is required, but exploitation demands that an attacker already occupy a position on the network path - a shared LAN segment, hostile Wi-Fi, compromised gateway or proxy, or an internal lateral foothold - making it a moderate-severity information-disclosure issue rather than a top-tier priority. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); internet-only attackers with no interception capability cannot trigger it.