Tracked app vulnerabilities

Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.

Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.

Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

HIGH · vendor

Mozilla Thunderbird

2026-11-10

For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured …

HIGH · vendor

Mozilla Thunderbird

2026-11-10

If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses b…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's u…

HIGH · vendor

Mozilla Thunderbird

2026-11-10

When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on…

Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privil…

Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate …

HIGH 8.8

2026-11-10

Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cr…

HIGH 8.8

2026-11-10

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (…

HIGH 8.8

2026-11-10

Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C…

HIGH 8.3

2026-11-10

Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary …

HIGH 8.8

Mozilla Firefox

2026-11-10

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.

HIGH · vendor

2026-11-10

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 1…

HIGH · vendor

Mozilla Firefox

2026-11-10

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH · vendor

Mozilla Firefox

2026-11-10

Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH 8.8

2026-11-10

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and T…

HIGH 8.8

Mozilla Firefox

2026-11-10

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH · vendor

Mozilla Firefox

2026-11-10

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH · vendor

Mozilla Firefox

2026-11-10

Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

HIGH 8.8

Mozilla Firefox

2026-11-10

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.