CriticalCVSS 9.8
EPSS 0.94%
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Technology
Windows vulnerabilities
Microsoft Windows client and server operating systems. 11,371 published CVES affecting Windows, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 11,371
- Critical
- 310
- High
- 7,791
- Medium
- 3,108
- Low
- 160
- Unscored
- 2
- CISA KEV
- 252
Latest Windows CVEs
Newest publication first · page 37 of 40 · showing the latest 1,000
-
-
HighCVSS 7.0 EPSS 0.21%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.35%
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.48%
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 5.5 EPSS 0.32%
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
-
MediumCVSS 4.7 EPSS 0.35%
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
-
MediumCVSS 5.5 EPSS 0.46%
Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.
-
HighCVSS 7.8 EPSS 0.35%
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 5.5 EPSS 0.44%
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
-
MediumCVSS 5.5 EPSS 0.38%
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
-
MediumCVSS 5.5 EPSS 0.44%
Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
-
CriticalCVSS 9.8 EPSS 1.0%
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.0 EPSS 0.28%
Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.19%
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.32%
Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
HighCVSS 8.8 EPSS 0.36%
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.35%
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.30%
Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
HighCVSS 8.8 EPSS 0.33%
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.37%
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.35%
Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.55%
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 5.5 EPSS 0.44%
Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
-
CriticalCVSS 9.8 EPSS 0.99%
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.
-
MediumCVSS 5.5 EPSS 0.46%
Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.