Windows

Next.js Windows Cache Path Traversal RCE (CVE-2026-75604) newCVE-2026-75604webCRITICAL 9Unverified2026-09-03Windows Media Player DLL Hijack -- Local Privilege Escalation (CVE-2026-21508) newCVE-2026-21508binaryHIGH 7.8Patched2026-08-16Microsoft SCCM — AdminService CAB Extraction Path-Traversal to SYSTEM RCE (CVE-2026-47301) newCVE-2026-47301networkCRITICAL 9.8Unverified2026-08-15Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912) newCVE-2026-27912networkHIGH 8Unverified2026-08-11Windows Defender — ShieldBreak: RoguePlanet (CVE-2026-50656) Patch Bypass via Cloud Files Rehydration + Object Manager Symlinks new EPSS 11%Bypass of CVE-2026-50656binaryHIGH 7.8Unpatched2026-08-11Active Directory — SPN Unicode Collision Detection Scanner (CVE-2026-25177) newCVE-2026-25177networkHIGH 8.8Patched2026-08-11Barrier 2.4.0 — barrierd.exe Unauthenticated IPC → SYSTEM Privilege Escalation (NotCVE-2026-0010) newNotCVE-2026-0010binaryHIGHUnverified2026-08-01Windows WalletService Known-Folder Redirection → ESE Persisted-Callback DLL Load Local Privilege Escalation (CVE-2026-49176) newCVE-2026-49176binaryHIGH 7.8Patched2026-07-27Windows Message Queuing (MSMQ) Queue Manager Heap-Based Buffer Overflow (CVE-2026-54992) newCVE-2026-54992networkHIGH 8.4Patched2026-07-27GreatXML — WinRE / Defender Offline-Scan Trust-Boundary Abuse → BitLocker Bypass (No CVE) newN/AbinaryHIGHUnpatched2026-07-27AD CS/AD FS Enrollment "cdc" Chase Attribute Abuse → Domain Controller Impersonation (CertiGhost, CVE-2026-54121) newCVE-2026-54121networkHIGH 8.8Patched2026-07-27LegacyHive - Windows user profile service arbitrary hive load elevation of privileges vulnerability new—binaryHIGHPatched2026-07-19React Native Community CLI Metro Dev Server `/open-url` OS Command Injection (CVE-2025-11953) new KEV EPSS 94%CVE-2025-11953networkCRITICAL 9.8Patched2026-07-06XIGNCODE3 Anti-Cheat Driver PPL-Bypass LSASS Credential Dump (CVE-2026-3609) newCVE-2026-3609binaryHIGHPatched2026-07-05Windows ShellLink (.lnk) Remote Code Execution — CVE-2026-21510 LNK-Stomping Generator new KEV EPSS 26%CVE-2026-21510social-engineeringHIGHUnverified2026-07-05Windows Shell LNK _IDCONTROLW Zero-Click SMB Coercion Builder — CVE-2026-32202 new KEV EPSS 64%CVE-2026-32202binaryHIGHUnverified2026-07-05Windows Push Notification Service Use-After-Free Race (CVE-2026-42978) newCVE-2026-42978binaryHIGH 7.8Unverified2026-07-05Windows Kernel Local Privilege Escalation via SeDebugPrivilege Bit Corruption (CVE-2026-40369) newCVE-2026-40369binaryHIGHUnverified2026-07-05Windows HTTP.sys Header-Count-Triggered Kernel Memory Corruption / BSOD (CVE-2026-49160) new EPSS 54%CVE-2026-49160binaryHIGHPatched2026-07-05Windows Error Reporting Service ALPC Local Privilege Escalation (CVE-2026-20817) newCVE-2026-20817binaryHIGHUnverified2026-07-05Notepad++ nativeLang.xml Format String Crash / Info Disclosure — CVE-2026-3008 newCVE-2026-3008binaryMEDIUMUnverified2026-07-05MiniTool pwdrvio.sys Kernel Write-What-Where — Local Privilege Escalation Primitive (CVE-2026-36981) newCVE-2026-36981binaryHIGHPatched2026-07-05MiniTool pwdrvio.sys Kernel Driver Buffer Overflow — Local DoS/BSOD (CVE-2026-36980) newCVE-2026-36980binaryMEDIUMPatched2026-07-05Microsoft Defender Link Following Local Privilege Escalation (CVE-2026-41091) new KEVCVE-2026-41091binaryHIGH 7.8Unpatched2026-07-05Lenovo LDE (LdeApi.Server.exe) Unimpersonated Junction-Based Arbitrary File Write to SYSTEM (CVE-2026-0827) newCVE-2026-0827binaryHIGHUnverified2026-07-05KillChain — Vulnerable Kernel Driver IOCTL Protected-Process Termination (CVE-2026-0828) newCVE-2026-0828binaryHIGHUnverified2026-07-05Discord Desktop Client Uncontrolled Search Path Element / Local Code Execution (CVE-2026-0776) newCVE-2026-0776binaryHIGH 7.3Unverified2026-07-05Balena Etcher Windows TOCTOU Privilege Escalation — CVE-2026-30332 newCVE-2026-30332binaryHIGHUnverified2026-07-05ASUS DriverHub Update TOCTOU Local Privilege Escalation — CVE-2026-1880 newCVE-2026-1880binaryMEDIUMPatched2026-07-05Apache Solr UNC Path Validation Bypass to RCE (CVE-2026-22444) newCVE-2026-22444webCRITICALPatched2026-07-05Amazon WorkSpaces Skylight Workspace Config Service Local Privilege Escalation (CVE-2026-7791) newCVE-2026-7791cloudHIGHUnverified2026-07-05VLC Bundled FFmpeg VP9 Decoder Resolution-Change Heap Crash newNone assigned as of 2026-07-03binaryMEDIUMUnverified2026-07-03System Informer phsvc Trusted-Host Confused Deputy LPE newNone assigned as of 2026-07-03binaryHIGHUnverified2026-07-03OpenVPN Connect Server-Pushed Option Current-User Command Execution newNone assigned as of 2026-07-03networkHIGHUnverified2026-07-03libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution newNone assigned as of 2026-07-03networkCRITICALUnverified2026-07-03ImageMagick Ghostscript Delegate Search Path Hijack newNone assigned as of 2026-07-03binaryHIGHUnverified2026-07-03Flowise Custom MCP Environment Variable Case Bypass newNone assigned as of 2026-07-03webHIGHUnverified2026-07-03AnyDesk Printer Pipe COM Impersonation Local Privilege Escalation newNone assigned as of 2026-07-03binaryHIGHUnverified2026-07-037-Zip RAR5 Mark-of-the-Web / ADS Full-Chain Bypass newNone assigned as of 2026-07-03miscHIGHUnverified2026-07-03Windows CTFMON Arbitrary Section Object EoP — GreenPlasma (CVE-2026-45586) newCVE-2026-45586binaryHIGH 7.8Patched2026-06-28Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800) newCVE-2026-48770, CVE-2026-48778, CVE-2026-48800binaryHIGH 5Patched2026-05-28Windows NTLM Hash Disclosure via File Explorer - CVE-2025-24054 new KEV EPSS 59%CVE-2025-24054binaryMEDIUM 6.5Unverified2026-05-17Windows MMC MSC EvilTwin - CVE-2025-26633 new KEV RW EPSS 30%CVE-2025-26633binaryHIGHUnverified2026-05-17ToolShell - SharePoint Unauthenticated RCE Chain new KEV RW EPSS 100%CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706webCRITICALPatched2026-05-17Windows OLE Zero-Click RCE via Outlook RTF (CVE-2025-21298) new EPSS 81%CVE-2025-21298binaryCRITICAL 9.8Patched2026-05-16Adobe Acrobat/Reader Prototype Pollution Sandbox Escape (CVE-2026-34621) new KEVCVE-2026-34621binaryCRITICAL 9.8Unverified2026-05-16WinRAR Archive Extraction Path Traversal (CVE-2025-6218) new KEV EPSS 90%CVE-2025-6218miscHIGHUnverified2026-05-15MiniPlasma - Windows Cloud Files Mini Filter Driver LPE (CVE-2020-17103) new EPSS 27%CVE-2020-17103binaryHIGH 7.8Patched2026-05-15HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2021-31166) new KEV EPSS 100%CVE-2021-31166networkCRITICAL 9.8Patched2026-05-15CVE-2024-21338 — Local Privilege Escalation from Admin to Kernel new KEV RW EPSS 60%CVE-2024-21338binaryHIGH 7.8Patched2026-05-15