| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows OLE allows an authorized attacker to disclose information locally. |
| Null pointer dereference in Windows Phone Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Release of invalid pointer or reference in Windows Brokering File System allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally. |
| A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network. |
| INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50. |
| A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50. |
| Use after free in Windows DIAL Client allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
| A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. |
