Tracked app vulnerabilities

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information…

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information loc…

Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally.

Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network.

Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.

Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network.

Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information local…

Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally.

Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally.

Use after free in Microsoft Office Word allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information…

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.

Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.

Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose …

Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security featu…

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

MEDIUM 6.5

2026-09-03

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web …

MEDIUM 4.2

2026-09-02

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof …

MEDIUM 6.5

2026-09-02

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin polic…

MEDIUM 4.3

2026-09-02

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium se…

MEDIUM 6.5

2026-09-02

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML…

MEDIUM 6.5

2026-09-02

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HT…

MEDIUM 5.4

2026-09-02

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page…

MEDIUM 5.3

2026-09-02

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process …

MEDIUM 6.5

2026-09-02

Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sen…

MEDIUM 5.3

2026-09-02

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so…

MEDIUM 6.1

2026-09-01

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

MEDIUM 6.5

2026-09-01

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

MEDIUM 4.3

2026-09-01

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

MEDIUM 6.1

2026-09-01

Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

MEDIUM 4.3

2026-09-01

Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

MEDIUM 5.4

2026-09-01

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

MEDIUM 5.4

2026-09-01

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderb…

MEDIUM 5.4

2026-09-01

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 1…

MEDIUM 5.4

2026-09-01

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbir…

MEDIUM 5.4

2026-09-01

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."