HighCVSS 7.8
EPSS 0.39%
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code locally.
Technology
Windows vulnerabilities
Microsoft Windows client and server operating systems. 11,371 published CVES affecting Windows, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 11,371
- Critical
- 310
- High
- 7,791
- Medium
- 3,108
- Low
- 160
- Unscored
- 2
- CISA KEV
- 252
Latest Windows CVEs
Newest publication first · page 8 of 40 · showing the latest 1,000
-
-
HighCVSS 7.0 EPSS 0.36%
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.31%
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.31%
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.31%
Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
-
MediumCVSS 4.7 EPSS 0.28%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to deny service locally.
-
MediumCVSS 6.6 EPSS 0.41%
Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.
-
HighCVSS 8.0 EPSS 0.59%
Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
-
HighCVSS 7.8 EPSS 0.35%
Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.0 EPSS 0.27%
Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.28%
Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
-
CriticalCVSS 9.8 EPSS 1.2%
Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
-
MediumCVSS 6.5 EPSS 0.68%
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.
-
HighCVSS 7.8 EPSS 0.27%
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
HighCVSS 8.8 EPSS 0.48%
Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network.
-
MediumCVSS 6.8 EPSS 0.34%
Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
-
HighCVSS 8.8 EPSS 0.26%
Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.
-
HighCVSS 7.8 EPSS 0.37%
Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
-
HighCVSS 7.0 EPSS 0.24%
Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.8 EPSS 0.26%
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
-
HighCVSS 7.5 EPSS 0.48%
Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.
-
HighCVSS 8.8 EPSS 0.95%
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.0 EPSS 0.27%
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
-
CVE-2026-123388 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
PublishedHighCVSS 7.8 EPSS 0.26%Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
-
HighCVSS 8.0 EPSS 0.81%
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.