HighCVSS 7.8
EPSS 0.31%
Use after free in Windows DIAL Client allows an authorized attacker to elevate privileges locally.
Technology
Windows vulnerabilities
Microsoft Windows client and server operating systems. 11,371 published CVES affecting Windows, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 11,371
- Critical
- 310
- High
- 7,791
- Medium
- 3,108
- Low
- 160
- Unscored
- 2
- CISA KEV
- 252
Latest Windows CVEs
Newest publication first · page 21 of 40 · showing the latest 1,000
-
-
HighCVSS 7.0 EPSS 0.20%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.36%
Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.26%
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
CriticalCVSS 9.8 EPSS 0.90%
Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.0 EPSS 0.26%
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.31%
Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.36%
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.31%
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.26%
Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.26%
Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 5.5 EPSS 0.39%
Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally.
-
HighCVSS 7.8 EPSS 0.31%
Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.36%
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.26%
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.31%
Access of resource using incompatible type ('type confusion') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.26%
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.31%
Heap-based buffer overflow in Windows User Manager Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.28%
Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.31%
Use after free in Windows Push Notification Core allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 5.6 EPSS 0.33%
Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally.
-
HighCVSS 7.0 EPSS 0.20%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 4.9 EPSS 1.2%
Use after free in DNS Server allows an authorized attacker to deny service over a network.
-
HighCVSS 7.8 EPSS 0.31%
Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
-
HighCVSS 8.8 EPSS 0.74%
Out-of-bounds write in DNS Server allows an authorized attacker to execute code over a network.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.