2025

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to p

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager

Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attack

Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attack

Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network.

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Compon

Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information local

Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclos

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privilege

Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Clie

Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locall

Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose inform

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allo

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Compon

Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Servic

Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privi

Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to

Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose i

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a n

Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized at

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to p

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to d

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices

Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally.

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized atta

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locall