CVE Brief Security Intelligence

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally

Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally

Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally

Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network

Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally

An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally

Adobe Commerce versions 2

Adobe Commerce versions 2

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally

Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally

Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally

Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally

Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally

Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally

Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally

Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally

Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally

Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes

A weak authentication in Fortinet FortiPAM 1

Path traversal in Ivanti Endpoint Manager allows a remote unauthenticated attacker to achieve remote code execution

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network

When tlsInsecure=False appears in a connection string, certificate validation is disabled

An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection')

Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network

Insecure deserialization in Ivanti Endpoint Manager allows a local authenticated attacker to escalate their privileges

Use after free in Xbox allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally

A vulnerability has been found in UTT 进取 518G up to V3v3

A vulnerability was found in UTT 进取 518G up to V3v3

A vulnerability was determined in UTT HiPER 2620G up to 3

Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an integer overflow

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

A vulnerability has been identified in SINEC NMS (All versions < V4

A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session

A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session

A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session

A stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session

Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the software package

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution

NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing

IBM Security Verify Access 10

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network

yt-grabber-tui is a terminal user interface application for downloading videos

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check

In imgsensor, there is a possible out of bounds write due to a missing bounds check

In gnss driver, there is a possible out of bounds write due to an incorrect bounds check

A vulnerability has been identified in Solid Edge SE2024 (All versions < V224

A vulnerability has been identified in Solid Edge SE2024 (All versions < V224

A vulnerability has been identified in Solid Edge SE2024 (All versions < V224

A vulnerability has been identified in Solid Edge SE2024 (All versions < V224

An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7

Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs

Buffer over-read in Storport

Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally

Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally