HighCVSS 7.8
EPSS 0.34%
Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.
Technology
Windows vulnerabilities
Microsoft Windows client and server operating systems. 11,371 published CVES affecting Windows, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 11,371
- Critical
- 310
- High
- 7,791
- Medium
- 3,108
- Low
- 160
- Unscored
- 2
- CISA KEV
- 252
Latest Windows CVEs
Newest publication first · page 3 of 40 · showing the latest 1,000
-
-
HighCVSS 8.1 EPSS 0.88%
Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.
-
HighCVSS 8.1 EPSS 0.72%
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
-
HighCVSS 8.8 EPSS 0.84%
Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.
-
HighCVSS 7.5 EPSS 0.68%
Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.
-
HighCVSS 7.5 EPSS 0.35%
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 5.9 EPSS 0.75%
Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-119945 Windows Modern Device Management (MDM) Remote Code Execution Vulnerability
PublishedHighCVSS 8.1 EPSS 0.72%Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.5 EPSS 0.62%
Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.
-
HighCVSS 7.8 EPSS 0.33%
Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 4.7 EPSS 0.38%
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
-
HighCVSS 7.8 EPSS 0.46%
Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally.
-
MediumCVSS 6.5 EPSS 1.1%
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network.
-
HighCVSS 7.8 EPSS 0.36%
Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.5 EPSS 0.62%
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
-
MediumCVSS 6.6 EPSS 0.47%
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges with a physical attack.
-
MediumCVSS 5.9 EPSS 0.87%
Integer underflow (wrap or wraparound) in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
-
MediumCVSS 6.8 EPSS 0.42%
Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
-
HighCVSS 8.8 EPSS 0.78%
Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.8 EPSS 0.34%
Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.5 EPSS 1.4%
Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.
-
HighCVSS 7.0 EPSS 0.21%
Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.39%
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.28%
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
-
HighCVSS 8.8 EPSS 0.39%
Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.