Fixes 55 records
Priority CRITICAL 93KEV
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.19254 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-416
Priority MEDIUM 51
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.12621 · Published 2025-04-08 · Fixed in 6.2.9200.25423, 6.3.9600.22523 +5 CWE-416
Priority MEDIUM 50
Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.1105 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-416
Priority MEDIUM 46
Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03522 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-1390
Priority MEDIUM 46
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.07134 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-59
Priority MEDIUM 44
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02573 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-400
Priority MEDIUM 44
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02726 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-400
Priority MEDIUM 44
Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.023 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-20
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02163 · Published 2025-04-08 · Fixed in 6.3.9600.22523, 10.0.14393.7969 +3 CWE-400
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02163 · Published 2025-04-08 · Fixed in 6.3.9600.22523, 10.0.14393.7969 +3 CWE-400
Priority MEDIUM 43
Stack-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01268 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-121
Priority MEDIUM 43
Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02272 · Published 2025-04-08 · Fixed in 6.2.9200.25423, 6.3.9600.22523 +5 CWE-410
Priority MEDIUM 43
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01606 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-122
Priority MEDIUM 43
Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02272 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-400
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02353 · Published 2025-04-08 · Fixed in 6.3.9600.22523, 10.0.14393.7969 +3 CWE-400
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02042 · Published 2025-04-08 · Fixed in 6.3.9600.22523, 10.0.14393.7969 +3 CWE-400
Priority MEDIUM 43
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01526 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-125
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02353 · Published 2025-04-08 · Fixed in 6.3.9600.22523, 10.0.14393.7969 +3 CWE-400
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02272 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-400
Priority MEDIUM 43
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01388 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-122
Priority MEDIUM 43
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01388 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-122
Priority MEDIUM 43
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01388 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-122
Priority MEDIUM 43
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02181 · Published 2025-04-08 · Fixed in 6.3.9600.22523, 10.0.14393.7969 +3 CWE-400
Priority MEDIUM 41
Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.00775 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-20
Priority MEDIUM 41
Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01785 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-416
Priority MEDIUM 40
Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.02623 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-284
Priority MEDIUM 40
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01519 · Published 2025-04-08 · Fixed in 1.2.6081.0, 10.0.10240.20978 +13 CWE-122
Priority MEDIUM 40
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01203 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.2.9200.25423 +6 CWE-416
Priority LOW 38
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00818 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +5 CWE-125
Priority LOW 38
Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01043 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-59
Priority LOW 38
Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.01424 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-591
Priority LOW 37
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00743 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +5 CWE-125
Priority LOW 37
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00774 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +2 CWE-125
Priority LOW 37
Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00583 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +10 CWE-121
Priority LOW 37
Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.01164 · Published 2025-04-08 · Fixed in 16.0.18730.20000, 16.0.14326.22331 +14 CWE-416
Priority LOW 37
Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00586 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-416
Priority LOW 37
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.01259 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-122
Priority LOW 37
Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00483 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +11 CWE-416
Priority LOW 36
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.0083 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-591
Priority LOW 35
Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.03569 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +10 CWE-284
Priority LOW 35
Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.03319 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-284
Priority LOW 34
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00861 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +9 CWE-693
Priority LOW 33
Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00347 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-591
Priority LOW 33
Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00461 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-122
Priority LOW 33
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01852 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-908
Priority LOW 33
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01852 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-126
Priority LOW 33
Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01852 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-200
Priority LOW 33
Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00337 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-591
Priority LOW 33
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01852 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-126
Priority LOW 33
Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00323 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-367
Priority LOW 32
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01662 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-126
Priority LOW 32
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01693 · Published 2025-04-08 · Fixed in 6.1.7601.27670, 6.0.6003.23220 +7 CWE-126
Priority LOW 29
Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01315 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-591
Priority LOW 28
Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.01535 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 6.2.9200.25423 +1 CWE-693
Priority LOW 27
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00879 · Published 2025-04-08 · Fixed in 10.0.10240.20978, 10.0.14393.7969 +12 CWE-125