windows 11 26h1 · threatengine.sh

Home/Product/microsoft windows 11 26h1

Product

microsoft windows 11 26h1

213 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

< 10.0.28000.2113

Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature l

< 10.0.28000.2113

Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

< 10.0.28000.2113

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorize

< 10.0.28000.2113

Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

< 10.0.28000.2113

Windows TCP/IP Denial of Service Vulnerability

< 10.0.28000.2113

Windows TCP/IP Denial of Service Vulnerability

< 10.0.28000.2113

Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.

< 10.0.28000.2113

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

< 10.0.28000.2113

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

< 10.0.28000.2113

Windows TCP/IP Denial of Service Vulnerability

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized

< 10.0.28000.2113

Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack

< 10.0.28000.2113

Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker

< 10.0.28000.2113

Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

< 10.0.28000.2113

Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feat

< 10.0.28000.2113

Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.

< 10.0.28000.2113

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

< 10.0.28000.2113

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorize

< 10.0.28000.2113

Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized

< 10.0.28000.2113

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorize

< 10.0.28000.2113

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorize

< 10.0.28000.2113

Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges l

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components al

< 10.0.28000.2113

Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service loc

< 10.0.28000.2113

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized

< 10.0.28000.2113

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an aut

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an aut

< 10.0.28000.2113

Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.

< 10.0.28000.2113

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an aut

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an aut

< 10.0.28000.2113

Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.

< 10.0.28000.2113

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

< 10.0.28000.2113

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver

< 10.0.28000.2113

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spo

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthoriz

< 10.0.28000.1836

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an aut

< 10.0.28000.1836

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

< 10.0.28000.1836

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

< 10.0.28000.1836

Use after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attac

< 10.0.28000.1836

Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

< 10.0.28000.1836

Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security

< 10.0.28000.1836

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

< 10.0.28000.1836

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

< 10.0.28000.1836

Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally.

< 10.0.28000.1836

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

< 10.0.28000.1836

Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

< 10.0.28000.1836

Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker

< 10.0.28000.1836

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

< 10.0.28000.1836

Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorize

< 10.0.28000.1836

Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.

< 10.0.28000.1836

Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows

< 10.0.28000.1836

Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges loc

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows a

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows a

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows a

< 10.0.28000.1836

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

< 10.0.28000.1836

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally.

< 10.0.28000.1836

Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.d

< 10.0.28000.1836

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.d

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System all

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows

< 10.0.28000.1836

Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an

< 10.0.28000.1836

Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.d

< 10.0.28000.1836

Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to discl

< 10.0.28000.1836

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose info

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an auth

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an auth

< 10.0.28000.1836

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose info

< 10.0.28000.1836

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose info

< 10.0.28000.1836

Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privi

< 10.0.28000.1836

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.

< 10.0.28000.1836

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny ser

< 10.0.28000.1836

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an auth

< 10.0.28000.1836

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

< 10.0.28000.1836

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

< 10.0.28000.1836

Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allow

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Dri

< 10.0.28000.1836

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to disclose information over

< 10.0.28000.1836

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized

< 10.0.28000.1836

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privi

< 10.0.28000.1836

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privi

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized

< 10.0.28000.1836

Use after free in Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) allows an authorized attacker to elevate privileges loc

< 10.0.28000.1836

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows

< 10.0.28000.1836

Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileg

< 10.0.28000.1836

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows TDI Translation Driver (tdx.sys) allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges lo

< 10.0.28000.1836

Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

< 10.0.28000.1836

Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges loc

< 10.0.28000.1836

Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allow

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver f

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows a

< 10.0.28000.1836

Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver f

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows a

< 10.0.28000.1836

Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges l

< 10.0.28000.1836

Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate

< 10.0.28000.1836

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate

< 10.0.28000.1836

Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.

< 10.0.28000.1836

Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability

< 10.0.28000.1836

Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1836

Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges lo

< 10.0.28000.1836

Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over

< 10.0.28000.1836

Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerf

< 10.0.28000.1836

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a sec

< 10.0.28000.1836

Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized

< 10.0.28000.1836

Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information

< 10.0.28000.1719

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.

< 10.0.28000.1719

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent net

< 10.0.28000.1719

Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges loc

< 10.0.28000.1719

Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an author

< 10.0.28000.1719

Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to per

< 10.0.28000.1719

Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network.

< 10.0.28000.1719

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

< 10.0.28000.1719

Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to e

< 10.0.28000.1719

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to e

< 10.0.28000.1719

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges local

< 10.0.28000.1719

Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code o

< 10.0.28000.1719

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

< 10.0.28000.1719

Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

< 10.0.28000.1719

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

< 10.0.28000.1719

Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.

< 10.0.28000.1719

Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service

< 10.0.28000.1719

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service

< 10.0.28000.1719

Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges loca

< 10.0.28000.1719

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized

< 10.0.28000.1719

Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.

< 10.0.28000.1719

Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over

< 10.0.28000.1719

Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

< 10.0.28000.1719

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

< 10.0.28000.1719

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Dr

< 10.0.28000.1719

Use after free in RPC Runtime allows an authorized attacker to execute code over a network.

< 10.0.28000.1719

Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin