Windows Kernel Elevation of Privilege Vulnerability

Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows SmartScreen Elevation of Privilege Vulnerability

Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.

Windows Management Instrumentation Information Disclosure Vulnerability

Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Windows DWM Core Library Elevation of Privilege Vulnerability

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Windows DWM Core Library Elevation of Privilege Vulnerability

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Windows DWM Core Library Elevation of Privilege Vulnerability

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.

Windows Kernel-Mode Drivers Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Windows Message Queuing Queue Manager Denial of Service Vulnerability

Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.

Windows Message Queuing Queue Manager Elevation of Privilege Vulnerability

Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.

Clipboard User Service Elevation of Privilege Vulnerability

Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

Clipboard User Service Elevation of Privilege Vulnerability

Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

Logic Bug in macOS State Management Enables Local Privilege Escalation to Root

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.

Windows DHCP Server Security Feature Bypass Vulnerability

Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

Aggregate DNS name chained pointer decompression work leads to degradation of service.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.