Tracked app vulnerabilities

Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network.

Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.

Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.

Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.

Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.

Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.

Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.

Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

HIGH · vendor

Mozilla Thunderbird

2026-11-10

For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured …

HIGH · vendor

Mozilla Thunderbird

2026-11-10

If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses b…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's u…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on…

Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privil…

Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a netwo…

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.