Tracked app vulnerabilities

Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally.

Weak authentication in Windows AppContainer allows an authorized attacker to disclose information locally.

Use after free in DNS Server allows an authorized attacker to deny service over a network.

Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information l…

Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to perform tampering locally.

Out-of-bounds read in Windows Event Viewer allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally.

Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network.

Improper certificate validation in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Untrusted pointer dereference in Windows Storage allows an authorized attacker to elevate privileges with a physical attack.

Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.

Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.

MEDIUM 5.5

Windows

2026-11-10

Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network.

Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.

Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.

Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a netwo…

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.

MEDIUM 5.5

Windows

2026-11-10

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack.

Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

MEDIUM 4.7

2026-11-10

Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (…

MEDIUM 4.7

2026-11-10

Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Ch…

MEDIUM 4.3

Mozilla Firefox

2026-11-10

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

MEDIUM 4.3

2026-11-10

Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

MEDIUM 4.3

2026-11-10

Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

MEDIUM 4.3

2026-11-10

Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird…

MEDIUM 4.3

Mozilla Firefox

2026-11-10

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

MEDIUM 4.3

2026-11-10

Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.…

MEDIUM 5.4

2026-11-03

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromi…

MEDIUM 6.5

2026-11-03

Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (…

MEDIUM 6.5

2026-11-03

Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium…