Windows CVE-2025-36366

Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX

Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by

The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/