Windows
Monthly
Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Local privilege escalation in Microsoft Power Automate for Desktop and Power Automate agent for virtual desktops (all versions before 2.71.115.26224) is achievable via a relative path traversal flaw (CWE-23). An authenticated local user with low privileges can exploit improperly sanitized file path construction within Power Automate's RPA engine or agent service - which operates at elevated privilege - to write to or execute from an unintended directory, achieving full local privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; vendor patch is available at version 2.71.115.26224.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows an authenticated low-privilege user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions via an out-of-bounds read (CWE-125) in the kernel-mode driver. The vulnerability spans over a dozen currently-supported Windows releases including Server 2019, 2022, and 2025. No public exploit or CISA KEV listing has been identified; Microsoft has released patches through its standard update channels.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
A DLL hijacking vulnerability exists in the installer for OM Workspace (Windows Edition) Ver 2.4 and earlier, allowing local attackers to execute arbitrary code with the privileges of the user running the installer. The vulnerability is reported by JPCERT and affects software from OM Digital Solutions Corporation. With a CVSS score of 7.8 (High), the vulnerability requires local access and user interaction but no special privileges, making it a moderate real-world risk for targeted attacks during software installation.
A remote code execution vulnerability (CVSS 8.4). High severity vulnerability requiring prompt remediation.
NVIDIA Model Optimizer for Windows and Linux contains an unsafe deserialization vulnerability in its ONNX quantization feature that allows attackers to execute arbitrary code by providing a malicious input file. Users who process untrusted ONNX model files are at risk of complete system compromise, including code execution, privilege escalation, data tampering, and information disclosure. There is no current evidence of active exploitation (not in CISA KEV) or public proof-of-concept availability.
OpenClaw 2026.1.21 through 2026.2.18 contains a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism. Local authenticated users with low privileges can execute arbitrary commands when spawn failures trigger shell fallback with cmd.exe, exploiting workflow-controlled parameters. A patch is available from the vendor, and while no KEV or EPSS data indicates active exploitation at this time, the vulnerability has a CVSS score of 7.0 (High).
OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in the Windows scheduled task script generation component. Attackers with low-level local privileges and control over service script generation values can inject cmd metacharacters into the gateway.cmd arguments to execute arbitrary commands with high impact to confidentiality, integrity, and availability. There is no indication of active exploitation (not in CISA KEV), but a patch commit is publicly available which may facilitate proof-of-concept development.
OpenClaw, an open-source game engine component, contains a command injection vulnerability in its Windows Scheduled Task script generation mechanism. Versions prior to 2026.2.18 write environment variables unquoted to gateway.cmd files, allowing attackers to inject shell metacharacters that break out of assignment context and execute arbitrary commands when the scheduled task runs. This vulnerability has a CVSS score of 7.4 (High) with local attack vector and high attack complexity, and a patch is currently available from the vendor.
An unauthenticated directory traversal vulnerability exists in Siyuan kernel's /appearance/ endpoint, allowing remote attackers to read arbitrary files accessible to the server process without authentication. The vulnerability affects the Go-based Siyuan note-taking application (github.com/siyuan-note/siyuan/kernel) and has been assigned a CVSS score of 7.5 (High). A working proof-of-concept exploit is publicly available demonstrating successful file retrieval via crafted URLs containing path traversal sequences, and a patch has been released by the vendor.
ScreenToGif, a widely-used screen recording application, is vulnerable to DLL sideloading attacks through a malicious version.dll file. Versions from 2.42.1 and earlier are affected when the portable executable is run from user-writable directories, which is the primary intended use case for this application. Attackers can achieve arbitrary code execution in the user's context with high impact on confidentiality, integrity, and availability. No public patches are available at the time of disclosure, and no evidence of active exploitation (KEV status) has been reported.
Heap corruption in Google Chrome's ANGLE graphics library on Windows versions prior to 146.0.7680.153 can be triggered through integer overflow when processing maliciously crafted HTML pages. An unauthenticated remote attacker can exploit this vulnerability by deceiving users into visiting a malicious website, potentially achieving arbitrary code execution. A patch is available across affected platforms including Google Chrome, Microsoft Edge, and various Linux distributions.
OpenClaw contains a local command injection vulnerability in Windows scheduled task script generation that allows authenticated local attackers to inject arbitrary commands through unsafe handling of cmd metacharacters and CR/LF sequences in gateway.cmd files. OpenClaw versions prior to 2026.2.19 are affected. Attackers with control over service script generation arguments can execute unintended code in the scheduled task context with high impact to integrity and availability.
A path traversal vulnerability in A Path Traversal vulnerability (CVSS 10.0). Critical severity with potential for significant impact on affected systems.
SiYuan's Bazaar marketplace fails to sanitize package metadata (displayName, description) before rendering in the Electron desktop application, allowing stored XSS that escalates to arbitrary remote code execution. Any SiYuan user (versions ≤3.5.9) who browses the Bazaar will automatically execute attacker-controlled code with full OS-level privileges when a malicious package card renders-no installation or user interaction required. A functional proof-of-concept exists demonstrating command execution via img onerror handlers, and this vulnerability is actively tracked in GitHub's advisory database (GHSA-mvpm-v6q4-m2pf), making it a critical supply-chain risk to the SiYuan user community.
SiYuan's Bazaar (community package marketplace) fails to sanitize HTML in package README files during rendering, allowing stored XSS that escalates to remote code execution due to unsafe Electron configuration. An attacker can submit a malicious package with embedded JavaScript in the README that executes with full Node.js access when any user views the package details in the Bazaar. This affects SiYuan versions 3.5.9 and earlier across Windows, macOS, and Linux, with a CVSS score of 9.6 and multiple real-world exploitation vectors including data theft, reverse shells, and persistent backdoors.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]
Privilege escalation in Microsoft Azure Connected Machine Agent on Windows allows local authenticated users to bypass authentication mechanisms and gain elevated system privileges. An attacker with existing local access can exploit alternate authentication paths to escalate their permissions without user interaction. No patch is currently available for this vulnerability affecting Arc Enabled Servers.
Remote code execution in Windows RRAS across Server 2016, 2022, and 2025 via an integer overflow vulnerability allows authenticated attackers to execute arbitrary code over the network with high privileges. Public exploit code exists for this vulnerability, and no patch is currently available. Authenticated users with network access can trigger the vulnerability through a simple interaction to gain complete system compromise.
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Privilege escalation in Windows DWM Core Library affects Windows 10 versions 21H2 and 1809 through a use-after-free memory corruption vulnerability that allows authenticated local attackers to gain system-level privileges. The vulnerability requires local access and valid user credentials but no user interaction, creating a significant risk for multi-user systems. No patch is currently available.
Privilege escalation in Windows Telephony Service through heap buffer overflow affects Windows 10 1607, Windows 11 25h2, and Windows Server 2012, allowing adjacent network attackers to gain elevated system access without authentication. The vulnerability has a high CVSS score of 8.8 but currently lacks a patch, creating significant risk for exposed systems. Exploitation requires network proximity but no user interaction.
Information disclosure in Windows GDI+ affects Windows 11 (24h2, 25h2) and Windows Server 2012/2016, allowing unauthenticated attackers to read sensitive data remotely through an out-of-bounds memory access vulnerability. The flaw requires no user interaction and can be exploited over the network to compromise confidentiality without modifying system data or availability. No patch is currently available for this high-severity vulnerability.
Windows Ancillary Function Driver for WinSock in Windows Server 2025, 2022, and Windows 10 1809 contains insufficient input validation that allows authenticated local users to escalate privileges. An attacker with local access and valid credentials can exploit this vulnerability to gain elevated system permissions, though no patch is currently available. This HIGH severity vulnerability affects multiple Windows Server and client versions with no active exploit mitigation path.
Windows Ancillary Function Driver for WinSock (AFD) in Windows 11 versions 24h2 and 26h1 contains a use-after-free vulnerability (CWE-416) that allows authenticated local attackers to escalate privileges through memory corruption. An attacker with local access could exploit this flaw to gain elevated system permissions, though no official patch is currently available.
Windows Ancillary Function Driver for WinSock in Windows 10 (all versions) and Windows 11 contains an access control weakness that enables authenticated local attackers to escalate privileges to system level. An attacker with standard user credentials can exploit this flaw to gain elevated rights on affected systems. No patch is currently available for this vulnerability.
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]
Windows Extensible File Allocation (exFAT) contains an out-of-bounds read vulnerability affecting Windows Server 2022, Windows 10 1607, and Windows 11 versions 23h2/25h2, enabling authenticated local users to escalate privileges with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user-level privileges to exploit, with no patch currently available. This flaw carries a CVSS score of 7.8 and affects multiple supported Windows versions across server and client platforms.
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow vulnerability exploitable by authenticated network attackers. Public exploit code exists for this vulnerability, enabling authenticated users to execute arbitrary code with high integrity and confidentiality impact. No patch is currently available, making this a critical exposure for affected Windows environments.
Remote code execution in Windows Routing and Remote Access Service (RRAS) across Windows Server 2012, 2022, and 2022 23h2 stems from an integer overflow vulnerability that authenticated network attackers can exploit with user interaction. Public exploit code exists for this vulnerability, enabling attackers to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. No patch is currently available.
Privilege escalation in Windows Authentication Methods (Windows 10 22H2, Windows 11 26H1) stems from a use-after-free memory vulnerability that allows authenticated local attackers to gain elevated system privileges. The flaw requires low user privileges and manual interaction but provides complete system compromise through code execution. No patch is currently available for this high-severity vulnerability.
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]
Local code execution in Windows System Image Manager (Windows 11 23h2, Windows Server 2019/2022) through unsafe deserialization of untrusted data. An authenticated local attacker can exploit this vulnerability to execute arbitrary code with elevated privileges. No patch is currently available.
Privilege escalation in Windows Performance Counters via null pointer dereference affects Windows Server 2019 and Windows 11 systems, enabling authenticated local attackers to gain elevated privileges. The vulnerability impacts systems where users have standard account access, allowing them to escalate to higher privilege levels on affected machines. No patch is currently available.
Privilege escalation in Windows Device Association Service (Windows 10 versions 1607, 1809, and 21H2) stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires high attack complexity and no user interaction, making it exploitable by insiders or compromised local accounts. No patch is currently available.
Privilege escalation in Windows Device Association Service across Windows 10, 11, and Server 2022 stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires local access and specific timing conditions but poses high risk due to its impact on confidentiality, integrity, and availability. No patch is currently available.
Privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) across Windows 10, Windows 11, and Windows Server 2022 stems from improper permission assignments on a critical resource. A local authenticated attacker can exploit this misconfiguration to gain elevated privileges without user interaction. No patch is currently available for this vulnerability.
Windows Projected File System in Windows 11 and Server 2022 contains improper access control that enables authenticated local users to escalate privileges to system level. An attacker with valid credentials can exploit this vulnerability to gain elevated permissions without user interaction. Currently, no patch is available to address this issue.
Windows Kernel path traversal vulnerability in Server 2025, Server 2022, Windows 11 24h2, and Windows 10 22h2 enables authenticated local attackers to achieve full system compromise through privilege escalation. The flaw allows an authorized user to manipulate file name or path parameters, bypassing access controls and gaining kernel-level privileges. No patch is currently available.
Privilege escalation in Windows 11 (24h2, 26h1) and Windows Server 2022 (23h2) via heap overflow allows authenticated local users to gain system-level access. The vulnerability requires valid credentials but no user interaction, making it a direct path to complete system compromise. No patch is currently available.
Windows MapUrlToZone security bypass in Windows 11 24H2, Windows 10 21H2, and Windows Server 2016/2025 allows unauthenticated remote attackers to circumvent zone-based security restrictions through improper path equivalence resolution. An attacker can exploit this network-accessible vulnerability without user interaction to bypass intended access controls. No patch is currently available for this high-severity vulnerability.
Windows ReFS contains an out-of-bounds read vulnerability affecting Server 2019, 2022, 2025, and Windows 11 26h1 that enables authenticated local users to escalate privileges with high impact to confidentiality, integrity, and availability. The vulnerability requires low attack complexity and no user interaction, making it exploitable by any authenticated user on the system. No patch is currently available for this HIGH severity issue.
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability [CVSS 7.8 HIGH]
Privilege escalation in the Windows Bluetooth RFCOM Protocol Driver across Windows 11 26h1, Windows Server 2025, and Windows 10 1809 stems from improper synchronization of concurrent access to shared resources. An authenticated local attacker can exploit this race condition to gain elevated privileges on affected systems. No patch is currently available for this vulnerability.
Remote code execution in Microsoft Windows Print Spooler Components via use-after-free memory corruption enables authenticated network attackers to execute arbitrary code with high privileges. The vulnerability requires valid credentials but no user interaction, presenting a significant risk to organizations where print services are accessible to untrusted internal or remote users. No patch is currently available.
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate their privileges. An attacker with valid credentials can exploit this vulnerability to gain elevated permissions on the system. No patch is currently available for this issue.
Improper symbolic link handling in Acronis Cyber Protect 17 for Windows (before build 41186) enables local attackers with limited privileges to escalate to system-level access through a race condition. An authenticated user can exploit this vulnerability to gain full control over the affected system, including reading sensitive data and modifying system configurations. No patch is currently available for this high-severity flaw.
Acronis Cyber Protect 17 for Windows before build 41186 allows local attackers with standard user privileges to escalate to system-level access through improper handling of symbolic links. An authenticated attacker can exploit this vulnerability to gain full control over the affected system, including the ability to read, modify, or delete sensitive data and execute arbitrary code. No patch is currently available for this vulnerability.
Acronis Cyber Protect 17 on Linux and Windows versions prior to build 41186 is vulnerable to denial of service through improper input validation in authentication logging functions. An unauthenticated remote attacker can crash the application or render it unavailable without requiring user interaction. No patch is currently available for this vulnerability.
Improper authentication in Acronis Cyber Protect 17.
Windows cmd.exe metacharacter injection in OpenClaw before 2026.2.2. Bypass exec whitelist. Patch available.
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat synchronization, enabling network eavesdropping attacks across Windows, macOS, Linux, iOS, and Android platforms. An attacker positioned to intercept network traffic can capture authentication credentials by sniffing the unencrypted JSON payload. No patch is currently available for this high-severity vulnerability (CVSS 8.7).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object prototype handling in its password security and configuration encryption modules, allowing local authenticated attackers to extract embedded sensitive data including passwords and machine identifiers. The vulnerability affects critical cryptographic functions including symmetric_crypt() and decrypt_str_or_original(), enabling attackers with local access and valid credentials to compromise encrypted credentials and system identifiers. No patch is currently available.
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web console export functions, enabling attackers to extract sensitive embedded data from exported configurations. This vulnerability affects Windows, macOS, and Linux deployments and requires no authentication or user interaction to exploit. No patch is currently available.
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive embedded data during config import, URI scheme handling, or CLI operations across Windows, macOS, Linux, iOS, Android, and web clients. An unauthenticated remote attacker can exploit this vulnerability without user interaction to extract sensitive configuration information. No patch is currently available for this high-severity vulnerability.
IDExpert Windows Logon Agent has a second RCE vulnerability through another unsigned code download path.
IDExpert Windows Logon Agent by Changing has an RCE vulnerability through download of code without integrity check, allowing malicious update injection.
Gradio versions up to 6.7 contains a vulnerability that allows attackers to read arbitrary files from the file system (CVSS 7.5).
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 7.5 HIGH]
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 7.5 HIGH]
Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory corruption. PoC and patch available.
Adb Explorer contains a vulnerability that allows attackers to set the binary's path to point to a remote network resource, hosted on an attack (CVSS 7.8).
Fiber web framework versions 3.0.0 and earlier on Windows contain a path traversal vulnerability that allows remote attackers to bypass static file middleware protections and read arbitrary files from the server. Public exploit code exists for this vulnerability, which affects applications using the vulnerable Fiber versions. The issue has been patched in Fiber v3.1.0.
Local privilege escalation via out-of-bounds memory read in Docker Desktop's grpcfuse kernel module (versions up to 4.61.0) on Linux, Windows, and macOS allows authenticated local attackers to achieve complete system compromise through manipulation of /proc/docker entries. The vulnerability requires local access and valid user credentials but enables reading and modifying arbitrary kernel memory with high impact on confidentiality, integrity, and availability. Docker Desktop 4.62.0 and later resolve this issue.
ADB Explorer through version 0.9.26020 fails to validate user-supplied directory paths, enabling local attackers to trigger recursive deletion of arbitrary filesystem directories including critical system and user folders. An attacker can exploit this by crafting a malicious shortcut or script that launches the application with a sensitive path argument, causing permanent data loss when the application processes the ClearDrag() function at startup or exit. Any user tricked into launching ADB Explorer via a weaponized shortcut or batch file faces complete loss of targeted directories such as Documents or user profile folders.
Remote code execution in Calibre 9.2.1 and earlier allows authenticated users to write arbitrary files via a path traversal flaw in the extract_pictures() function that fails to properly sanitize directory traversal sequences. On Windows systems, attackers can exploit this to write malicious payloads to the Startup folder, achieving code execution upon the next user login. Public exploit code exists for this vulnerability, and a patch is available in version 9.3.0.
Arbitrary code execution in ADB Explorer version 0.9.26020 and earlier on Windows allows local attackers to execute malicious binaries by manipulating the ManualAdbPath configuration setting without integrity validation. An attacker can exploit this through social engineering by distributing a crafted settings file that redirects the application to a malicious executable, gaining code execution with user privileges. The vulnerability requires user interaction to launch the application with a malicious configuration directory.
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits attackers to hijack the Windows Explorer executable if they control the process working directory. A user with local access running the affected application could be tricked into executing a malicious explorer.exe, leading to arbitrary code execution with application privileges. Public exploit code exists for this vulnerability and no patch is currently available.
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileges on affected Windows systems. An attacker with valid credentials could exploit this weakness to escalate their access level without additional user interaction. A patch is available to remediate this high-severity vulnerability.
Total VPN 0.5.29.0 on Windows contains an unquoted search path vulnerability in win-service.exe that allows local attackers with low privileges to achieve code execution through path manipulation. The vulnerability requires high attack complexity and local access, but no patch is currently available from the vendor.
Local privilege escalation in Calero VeraSMART versions before 2026 R1 stems from hardcoded AES encryption keys embedded in Veramark.Framework.dll that protect service account credentials stored in app.settings. An attacker with local system access can extract these static keys, decrypt the stored passwords, and use the recovered credentials to authenticate as the service account, potentially gaining elevated privileges depending on that account's permissions. No patch is currently available for this vulnerability.
ADB Explorer on Windows versions prior to Beta 0.9.26020 allows local attackers to achieve remote code execution by crafting a malicious App.txt settings file that exploits insecure JSON deserialization with enabled type name handling. An attacker can inject a gadget chain payload into the configuration file that executes arbitrary code when the application launches and processes settings. No patch is currently available for affected versions.
Privilege escalation in Dell iDRAC Service Module (Windows versions before 6.0.3.1 and Linux versions before 5.4.1.1) stems from improper access controls that allow local users with low privileges to gain elevated system access. An attacker with local access can exploit this vulnerability to obtain administrative capabilities on affected systems. No patch is currently available for this issue affecting both Windows and Linux environments.
Unauthenticated attackers can read sensitive configuration files from SiYuan knowledge management systems prior to version 3.5.5 by exploiting case-sensitivity bypass in file access controls on Windows and other case-insensitive filesystems. The /api/file/getFile endpoint fails to properly validate mixed-case path traversal attempts, allowing unauthorized access to protected data. Public exploit code exists for this vulnerability, and no patch is currently available.
Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Local privilege escalation in Microsoft Power Automate for Desktop and Power Automate agent for virtual desktops (all versions before 2.71.115.26224) is achievable via a relative path traversal flaw (CWE-23). An authenticated local user with low privileges can exploit improperly sanitized file path construction within Power Automate's RPA engine or agent service - which operates at elevated privilege - to write to or execute from an unintended directory, achieving full local privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; vendor patch is available at version 2.71.115.26224.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows an authenticated low-privilege user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions via an out-of-bounds read (CWE-125) in the kernel-mode driver. The vulnerability spans over a dozen currently-supported Windows releases including Server 2019, 2022, and 2025. No public exploit or CISA KEV listing has been identified; Microsoft has released patches through its standard update channels.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
A DLL hijacking vulnerability exists in the installer for OM Workspace (Windows Edition) Ver 2.4 and earlier, allowing local attackers to execute arbitrary code with the privileges of the user running the installer. The vulnerability is reported by JPCERT and affects software from OM Digital Solutions Corporation. With a CVSS score of 7.8 (High), the vulnerability requires local access and user interaction but no special privileges, making it a moderate real-world risk for targeted attacks during software installation.
A remote code execution vulnerability (CVSS 8.4). High severity vulnerability requiring prompt remediation.
NVIDIA Model Optimizer for Windows and Linux contains an unsafe deserialization vulnerability in its ONNX quantization feature that allows attackers to execute arbitrary code by providing a malicious input file. Users who process untrusted ONNX model files are at risk of complete system compromise, including code execution, privilege escalation, data tampering, and information disclosure. There is no current evidence of active exploitation (not in CISA KEV) or public proof-of-concept availability.
OpenClaw 2026.1.21 through 2026.2.18 contains a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism. Local authenticated users with low privileges can execute arbitrary commands when spawn failures trigger shell fallback with cmd.exe, exploiting workflow-controlled parameters. A patch is available from the vendor, and while no KEV or EPSS data indicates active exploitation at this time, the vulnerability has a CVSS score of 7.0 (High).
OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in the Windows scheduled task script generation component. Attackers with low-level local privileges and control over service script generation values can inject cmd metacharacters into the gateway.cmd arguments to execute arbitrary commands with high impact to confidentiality, integrity, and availability. There is no indication of active exploitation (not in CISA KEV), but a patch commit is publicly available which may facilitate proof-of-concept development.
OpenClaw, an open-source game engine component, contains a command injection vulnerability in its Windows Scheduled Task script generation mechanism. Versions prior to 2026.2.18 write environment variables unquoted to gateway.cmd files, allowing attackers to inject shell metacharacters that break out of assignment context and execute arbitrary commands when the scheduled task runs. This vulnerability has a CVSS score of 7.4 (High) with local attack vector and high attack complexity, and a patch is currently available from the vendor.
An unauthenticated directory traversal vulnerability exists in Siyuan kernel's /appearance/ endpoint, allowing remote attackers to read arbitrary files accessible to the server process without authentication. The vulnerability affects the Go-based Siyuan note-taking application (github.com/siyuan-note/siyuan/kernel) and has been assigned a CVSS score of 7.5 (High). A working proof-of-concept exploit is publicly available demonstrating successful file retrieval via crafted URLs containing path traversal sequences, and a patch has been released by the vendor.
ScreenToGif, a widely-used screen recording application, is vulnerable to DLL sideloading attacks through a malicious version.dll file. Versions from 2.42.1 and earlier are affected when the portable executable is run from user-writable directories, which is the primary intended use case for this application. Attackers can achieve arbitrary code execution in the user's context with high impact on confidentiality, integrity, and availability. No public patches are available at the time of disclosure, and no evidence of active exploitation (KEV status) has been reported.
Heap corruption in Google Chrome's ANGLE graphics library on Windows versions prior to 146.0.7680.153 can be triggered through integer overflow when processing maliciously crafted HTML pages. An unauthenticated remote attacker can exploit this vulnerability by deceiving users into visiting a malicious website, potentially achieving arbitrary code execution. A patch is available across affected platforms including Google Chrome, Microsoft Edge, and various Linux distributions.
OpenClaw contains a local command injection vulnerability in Windows scheduled task script generation that allows authenticated local attackers to inject arbitrary commands through unsafe handling of cmd metacharacters and CR/LF sequences in gateway.cmd files. OpenClaw versions prior to 2026.2.19 are affected. Attackers with control over service script generation arguments can execute unintended code in the scheduled task context with high impact to integrity and availability.
A path traversal vulnerability in A Path Traversal vulnerability (CVSS 10.0). Critical severity with potential for significant impact on affected systems.
SiYuan's Bazaar marketplace fails to sanitize package metadata (displayName, description) before rendering in the Electron desktop application, allowing stored XSS that escalates to arbitrary remote code execution. Any SiYuan user (versions ≤3.5.9) who browses the Bazaar will automatically execute attacker-controlled code with full OS-level privileges when a malicious package card renders-no installation or user interaction required. A functional proof-of-concept exists demonstrating command execution via img onerror handlers, and this vulnerability is actively tracked in GitHub's advisory database (GHSA-mvpm-v6q4-m2pf), making it a critical supply-chain risk to the SiYuan user community.
SiYuan's Bazaar (community package marketplace) fails to sanitize HTML in package README files during rendering, allowing stored XSS that escalates to remote code execution due to unsafe Electron configuration. An attacker can submit a malicious package with embedded JavaScript in the README that executes with full Node.js access when any user views the package details in the Bazaar. This affects SiYuan versions 3.5.9 and earlier across Windows, macOS, and Linux, with a CVSS score of 9.6 and multiple real-world exploitation vectors including data theft, reverse shells, and persistent backdoors.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]
Privilege escalation in Microsoft Azure Connected Machine Agent on Windows allows local authenticated users to bypass authentication mechanisms and gain elevated system privileges. An attacker with existing local access can exploit alternate authentication paths to escalate their permissions without user interaction. No patch is currently available for this vulnerability affecting Arc Enabled Servers.
Remote code execution in Windows RRAS across Server 2016, 2022, and 2025 via an integer overflow vulnerability allows authenticated attackers to execute arbitrary code over the network with high privileges. Public exploit code exists for this vulnerability, and no patch is currently available. Authenticated users with network access can trigger the vulnerability through a simple interaction to gain complete system compromise.
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Privilege escalation in Windows DWM Core Library affects Windows 10 versions 21H2 and 1809 through a use-after-free memory corruption vulnerability that allows authenticated local attackers to gain system-level privileges. The vulnerability requires local access and valid user credentials but no user interaction, creating a significant risk for multi-user systems. No patch is currently available.
Privilege escalation in Windows Telephony Service through heap buffer overflow affects Windows 10 1607, Windows 11 25h2, and Windows Server 2012, allowing adjacent network attackers to gain elevated system access without authentication. The vulnerability has a high CVSS score of 8.8 but currently lacks a patch, creating significant risk for exposed systems. Exploitation requires network proximity but no user interaction.
Information disclosure in Windows GDI+ affects Windows 11 (24h2, 25h2) and Windows Server 2012/2016, allowing unauthenticated attackers to read sensitive data remotely through an out-of-bounds memory access vulnerability. The flaw requires no user interaction and can be exploited over the network to compromise confidentiality without modifying system data or availability. No patch is currently available for this high-severity vulnerability.
Windows Ancillary Function Driver for WinSock in Windows Server 2025, 2022, and Windows 10 1809 contains insufficient input validation that allows authenticated local users to escalate privileges. An attacker with local access and valid credentials can exploit this vulnerability to gain elevated system permissions, though no patch is currently available. This HIGH severity vulnerability affects multiple Windows Server and client versions with no active exploit mitigation path.
Windows Ancillary Function Driver for WinSock (AFD) in Windows 11 versions 24h2 and 26h1 contains a use-after-free vulnerability (CWE-416) that allows authenticated local attackers to escalate privileges through memory corruption. An attacker with local access could exploit this flaw to gain elevated system permissions, though no official patch is currently available.
Windows Ancillary Function Driver for WinSock in Windows 10 (all versions) and Windows 11 contains an access control weakness that enables authenticated local attackers to escalate privileges to system level. An attacker with standard user credentials can exploit this flaw to gain elevated rights on affected systems. No patch is currently available for this vulnerability.
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]
Windows Extensible File Allocation (exFAT) contains an out-of-bounds read vulnerability affecting Windows Server 2022, Windows 10 1607, and Windows 11 versions 23h2/25h2, enabling authenticated local users to escalate privileges with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user-level privileges to exploit, with no patch currently available. This flaw carries a CVSS score of 7.8 and affects multiple supported Windows versions across server and client platforms.
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow vulnerability exploitable by authenticated network attackers. Public exploit code exists for this vulnerability, enabling authenticated users to execute arbitrary code with high integrity and confidentiality impact. No patch is currently available, making this a critical exposure for affected Windows environments.
Remote code execution in Windows Routing and Remote Access Service (RRAS) across Windows Server 2012, 2022, and 2022 23h2 stems from an integer overflow vulnerability that authenticated network attackers can exploit with user interaction. Public exploit code exists for this vulnerability, enabling attackers to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. No patch is currently available.
Privilege escalation in Windows Authentication Methods (Windows 10 22H2, Windows 11 26H1) stems from a use-after-free memory vulnerability that allows authenticated local attackers to gain elevated system privileges. The flaw requires low user privileges and manual interaction but provides complete system compromise through code execution. No patch is currently available for this high-severity vulnerability.
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]
Local code execution in Windows System Image Manager (Windows 11 23h2, Windows Server 2019/2022) through unsafe deserialization of untrusted data. An authenticated local attacker can exploit this vulnerability to execute arbitrary code with elevated privileges. No patch is currently available.
Privilege escalation in Windows Performance Counters via null pointer dereference affects Windows Server 2019 and Windows 11 systems, enabling authenticated local attackers to gain elevated privileges. The vulnerability impacts systems where users have standard account access, allowing them to escalate to higher privilege levels on affected machines. No patch is currently available.
Privilege escalation in Windows Device Association Service (Windows 10 versions 1607, 1809, and 21H2) stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires high attack complexity and no user interaction, making it exploitable by insiders or compromised local accounts. No patch is currently available.
Privilege escalation in Windows Device Association Service across Windows 10, 11, and Server 2022 stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires local access and specific timing conditions but poses high risk due to its impact on confidentiality, integrity, and availability. No patch is currently available.
Privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) across Windows 10, Windows 11, and Windows Server 2022 stems from improper permission assignments on a critical resource. A local authenticated attacker can exploit this misconfiguration to gain elevated privileges without user interaction. No patch is currently available for this vulnerability.
Windows Projected File System in Windows 11 and Server 2022 contains improper access control that enables authenticated local users to escalate privileges to system level. An attacker with valid credentials can exploit this vulnerability to gain elevated permissions without user interaction. Currently, no patch is available to address this issue.
Windows Kernel path traversal vulnerability in Server 2025, Server 2022, Windows 11 24h2, and Windows 10 22h2 enables authenticated local attackers to achieve full system compromise through privilege escalation. The flaw allows an authorized user to manipulate file name or path parameters, bypassing access controls and gaining kernel-level privileges. No patch is currently available.
Privilege escalation in Windows 11 (24h2, 26h1) and Windows Server 2022 (23h2) via heap overflow allows authenticated local users to gain system-level access. The vulnerability requires valid credentials but no user interaction, making it a direct path to complete system compromise. No patch is currently available.
Windows MapUrlToZone security bypass in Windows 11 24H2, Windows 10 21H2, and Windows Server 2016/2025 allows unauthenticated remote attackers to circumvent zone-based security restrictions through improper path equivalence resolution. An attacker can exploit this network-accessible vulnerability without user interaction to bypass intended access controls. No patch is currently available for this high-severity vulnerability.
Windows ReFS contains an out-of-bounds read vulnerability affecting Server 2019, 2022, 2025, and Windows 11 26h1 that enables authenticated local users to escalate privileges with high impact to confidentiality, integrity, and availability. The vulnerability requires low attack complexity and no user interaction, making it exploitable by any authenticated user on the system. No patch is currently available for this HIGH severity issue.
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability [CVSS 7.8 HIGH]
Privilege escalation in the Windows Bluetooth RFCOM Protocol Driver across Windows 11 26h1, Windows Server 2025, and Windows 10 1809 stems from improper synchronization of concurrent access to shared resources. An authenticated local attacker can exploit this race condition to gain elevated privileges on affected systems. No patch is currently available for this vulnerability.
Remote code execution in Microsoft Windows Print Spooler Components via use-after-free memory corruption enables authenticated network attackers to execute arbitrary code with high privileges. The vulnerability requires valid credentials but no user interaction, presenting a significant risk to organizations where print services are accessible to untrusted internal or remote users. No patch is currently available.
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate their privileges. An attacker with valid credentials can exploit this vulnerability to gain elevated permissions on the system. No patch is currently available for this issue.
Improper symbolic link handling in Acronis Cyber Protect 17 for Windows (before build 41186) enables local attackers with limited privileges to escalate to system-level access through a race condition. An authenticated user can exploit this vulnerability to gain full control over the affected system, including reading sensitive data and modifying system configurations. No patch is currently available for this high-severity flaw.
Acronis Cyber Protect 17 for Windows before build 41186 allows local attackers with standard user privileges to escalate to system-level access through improper handling of symbolic links. An authenticated attacker can exploit this vulnerability to gain full control over the affected system, including the ability to read, modify, or delete sensitive data and execute arbitrary code. No patch is currently available for this vulnerability.
Acronis Cyber Protect 17 on Linux and Windows versions prior to build 41186 is vulnerable to denial of service through improper input validation in authentication logging functions. An unauthenticated remote attacker can crash the application or render it unavailable without requiring user interaction. No patch is currently available for this vulnerability.
Improper authentication in Acronis Cyber Protect 17.
Windows cmd.exe metacharacter injection in OpenClaw before 2026.2.2. Bypass exec whitelist. Patch available.
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat synchronization, enabling network eavesdropping attacks across Windows, macOS, Linux, iOS, and Android platforms. An attacker positioned to intercept network traffic can capture authentication credentials by sniffing the unencrypted JSON payload. No patch is currently available for this high-severity vulnerability (CVSS 8.7).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object prototype handling in its password security and configuration encryption modules, allowing local authenticated attackers to extract embedded sensitive data including passwords and machine identifiers. The vulnerability affects critical cryptographic functions including symmetric_crypt() and decrypt_str_or_original(), enabling attackers with local access and valid credentials to compromise encrypted credentials and system identifiers. No patch is currently available.
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web console export functions, enabling attackers to extract sensitive embedded data from exported configurations. This vulnerability affects Windows, macOS, and Linux deployments and requires no authentication or user interaction to exploit. No patch is currently available.
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive embedded data during config import, URI scheme handling, or CLI operations across Windows, macOS, Linux, iOS, Android, and web clients. An unauthenticated remote attacker can exploit this vulnerability without user interaction to extract sensitive configuration information. No patch is currently available for this high-severity vulnerability.
IDExpert Windows Logon Agent has a second RCE vulnerability through another unsigned code download path.
IDExpert Windows Logon Agent by Changing has an RCE vulnerability through download of code without integrity check, allowing malicious update injection.
Gradio versions up to 6.7 contains a vulnerability that allows attackers to read arbitrary files from the file system (CVSS 7.5).
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 7.5 HIGH]
FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 7.5 HIGH]
Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory corruption. PoC and patch available.
Adb Explorer contains a vulnerability that allows attackers to set the binary's path to point to a remote network resource, hosted on an attack (CVSS 7.8).
Fiber web framework versions 3.0.0 and earlier on Windows contain a path traversal vulnerability that allows remote attackers to bypass static file middleware protections and read arbitrary files from the server. Public exploit code exists for this vulnerability, which affects applications using the vulnerable Fiber versions. The issue has been patched in Fiber v3.1.0.
Local privilege escalation via out-of-bounds memory read in Docker Desktop's grpcfuse kernel module (versions up to 4.61.0) on Linux, Windows, and macOS allows authenticated local attackers to achieve complete system compromise through manipulation of /proc/docker entries. The vulnerability requires local access and valid user credentials but enables reading and modifying arbitrary kernel memory with high impact on confidentiality, integrity, and availability. Docker Desktop 4.62.0 and later resolve this issue.
ADB Explorer through version 0.9.26020 fails to validate user-supplied directory paths, enabling local attackers to trigger recursive deletion of arbitrary filesystem directories including critical system and user folders. An attacker can exploit this by crafting a malicious shortcut or script that launches the application with a sensitive path argument, causing permanent data loss when the application processes the ClearDrag() function at startup or exit. Any user tricked into launching ADB Explorer via a weaponized shortcut or batch file faces complete loss of targeted directories such as Documents or user profile folders.
Remote code execution in Calibre 9.2.1 and earlier allows authenticated users to write arbitrary files via a path traversal flaw in the extract_pictures() function that fails to properly sanitize directory traversal sequences. On Windows systems, attackers can exploit this to write malicious payloads to the Startup folder, achieving code execution upon the next user login. Public exploit code exists for this vulnerability, and a patch is available in version 9.3.0.
Arbitrary code execution in ADB Explorer version 0.9.26020 and earlier on Windows allows local attackers to execute malicious binaries by manipulating the ManualAdbPath configuration setting without integrity validation. An attacker can exploit this through social engineering by distributing a crafted settings file that redirects the application to a malicious executable, gaining code execution with user privileges. The vulnerability requires user interaction to launch the application with a malicious configuration directory.
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits attackers to hijack the Windows Explorer executable if they control the process working directory. A user with local access running the affected application could be tricked into executing a malicious explorer.exe, leading to arbitrary code execution with application privileges. Public exploit code exists for this vulnerability and no patch is currently available.
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileges on affected Windows systems. An attacker with valid credentials could exploit this weakness to escalate their access level without additional user interaction. A patch is available to remediate this high-severity vulnerability.
Total VPN 0.5.29.0 on Windows contains an unquoted search path vulnerability in win-service.exe that allows local attackers with low privileges to achieve code execution through path manipulation. The vulnerability requires high attack complexity and local access, but no patch is currently available from the vendor.
Local privilege escalation in Calero VeraSMART versions before 2026 R1 stems from hardcoded AES encryption keys embedded in Veramark.Framework.dll that protect service account credentials stored in app.settings. An attacker with local system access can extract these static keys, decrypt the stored passwords, and use the recovered credentials to authenticate as the service account, potentially gaining elevated privileges depending on that account's permissions. No patch is currently available for this vulnerability.
ADB Explorer on Windows versions prior to Beta 0.9.26020 allows local attackers to achieve remote code execution by crafting a malicious App.txt settings file that exploits insecure JSON deserialization with enabled type name handling. An attacker can inject a gadget chain payload into the configuration file that executes arbitrary code when the application launches and processes settings. No patch is currently available for affected versions.
Privilege escalation in Dell iDRAC Service Module (Windows versions before 6.0.3.1 and Linux versions before 5.4.1.1) stems from improper access controls that allow local users with low privileges to gain elevated system access. An attacker with local access can exploit this vulnerability to obtain administrative capabilities on affected systems. No patch is currently available for this issue affecting both Windows and Linux environments.
Unauthenticated attackers can read sensitive configuration files from SiYuan knowledge management systems prior to version 3.5.5 by exploiting case-sensitivity bypass in file access controls on Windows and other case-insensitive filesystems. The /api/file/getFile endpoint fails to properly validate mixed-case path traversal attempts, allowing unauthorized access to protected data. Public exploit code exists for this vulnerability, and no patch is currently available.