Tracked app vulnerabilities

Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.

Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.

Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.

Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.

Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

HIGH · vendor

Mozilla Thunderbird

2026-11-10

For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured …

HIGH · vendor

Mozilla Thunderbird

2026-11-10

If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses b…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's u…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on…

Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privil…

Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate …

Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally.

Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

HIGH 8.8

2026-11-10

Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cr…

HIGH 8.8

2026-11-10

Rejected reason: Duplicate CVE. Replaced by CVE-2026-125350

HIGH 8.8

2026-11-10

Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C…

HIGH 8.3

2026-11-10

Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary …