Tracked app vulnerabilities

Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate …

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.

Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack.

Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally.

Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

LOW 3.4

2026-11-10

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read …

HIGH 8.8

2026-11-10

Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cr…

CRITICAL 9.6

2026-11-10

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code…

HIGH 8.8

2026-11-10

Rejected reason: Duplicate CVE. Replaced by CVE-2026-125350

MEDIUM 4.7

2026-11-10

Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (…

HIGH 8.8

2026-11-10

Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C…

HIGH 8.3

2026-11-10

Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary …

MEDIUM 4.7

2026-11-10

Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Ch…

HIGH 8.8

Mozilla Firefox

2026-11-10

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.

HIGH · vendor

2026-11-10

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1…

HIGH · vendor

Mozilla Firefox

2026-11-10

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH · vendor

Mozilla Firefox

2026-11-10

Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH 8.8

2026-11-10

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and T…

HIGH 8.8

Mozilla Firefox

2026-11-10

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH · vendor

Mozilla Firefox

2026-11-10

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH · vendor

Mozilla Firefox

2026-11-10

Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

MEDIUM 4.3

Mozilla Firefox

2026-11-10

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH 8.8

Mozilla Firefox

2026-11-10

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.