Priority CRITICAL 100KEV
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9998 · Published 2025-10-14 · Fixed in 6.2.9200.25728, 6.3.9600.22826 +5 CWE-502
Priority CRITICAL 100KEV
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.99389 · Published 2020-08-17 · Partial fix · publication
Priority CRITICAL 100KEV
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.96721 · Published 2020-07-14 · No fix listed CWE-20
Priority CRITICAL 100KEV
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.74164 · Published 2017-06-15 · No fix listed CWE-281
Priority CRITICAL 100KEV
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remo…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99999 · Published 2015-04-14 · No fix listed CWE-94
Priority CRITICAL 98KEV
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Exe…
CVSS 3.1CRITICAL 9.0· Adjacent network · Low privileges · No interaction · EPSS 0.07558 · Published 2020-07-14 · No fix listed CWE-20
Priority CRITICAL 97KEV
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.09813 · Published 2026-10-13 · Fixed in 154.0.4258.62, 20260925.100 +12 CWE-77
Priority CRITICAL 97KEV
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.15852 · Published 2026-02-10 · Fixed in 10.0.14393.8868, 10.0.17763.8389 +11 CWE-693
Priority CRITICAL 97KEV
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.61238 · Published 2026-02-10 · Fixed in 10.0.14393.8868, 10.0.17763.8389 +11 CWE-693
Priority CRITICAL 97KEV
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.82829 · Published 2025-06-10 · Fixed in 10.0.10240.21034, 10.0.14393.8148 +12 CWE-284
Priority CRITICAL 97KEV
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.87135 · Published 2025-06-10 · Fixed in 10.0.10240.21034, 10.0.14393.8148 +12 CWE-73
Priority CRITICAL 97KEV
Windows MSHTML Platform Spoofing Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.54486 · Published 2024-09-10 · Fixed in 10.0.10240.20766, 10.0.14393.7336 +13 CWE-451
Priority CRITICAL 97KEV
Windows SmartScreen Security Feature Bypass Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.88196 · Published 2023-11-14 · Fixed in 10.0.17763.5122, 10.0.20348.2113 +12
Priority CRITICAL 97KEV
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.34206 · Published 2023-01-10 · Fixed in 10.0.17763.3887, 10.0.20348.1487 +8 CWE-416
Priority CRITICAL 97KEV
Windows Scripting Languages Remote Code Execution Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.24623 · Published 2022-11-09 · Fixed in 10.0.10240.19567, 10.0.14393.5501 +11 CWE-787
Priority CRITICAL 97KEV
Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.835 · Published 2022-05-10 · Fixed in 10.0.17763.4252, 10.0.18363.2274 +8 CWE-295
Priority CRITICAL 97KEV
Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.7717 · Published 2021-11-10 · Fixed in 6.1.7601.25769, 6.0.6003.21282 +6
Priority CRITICAL 97KEV
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.9784 · Published 2021-09-15 · Fixed in 10.0.10240.19060, 10.0.14393.4651 +10 CWE-22
Priority CRITICAL 97KEV
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.99792 · Published 2021-07-02 · Fixed in 10.0.10240.18969, 10.0.14393.4470 +11
Priority CRITICAL 97KEV
Scripting Engine Memory Corruption Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.40062 · Published 2021-07-16 · Fixed in 10.0.10240.19003, 10.0.14393.4530 +8 CWE-787
Priority CRITICAL 97KEV
Windows MSHTML Platform Remote Code Execution Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.59407 · Published 2021-06-08 · Fixed in 10.0.17763.1999, 10.0.18363.1621 +11 CWE-787
Priority CRITICAL 97KEV
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems exce…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.65037 · Published 2020-04-15 · Fixed CWE-787
Priority CRITICAL 97KEV
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.21713 · Published 2019-05-16 · No fix listed
Priority CRITICAL 97KEV
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.73037 · Published 2018-05-09 · No fix listed CWE-502
Priority CRITICAL 97KEV
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows loc…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.90026 · Published 2017-06-15 · No fix listed
Load more
THREATIST.IORead the docs