Microsoft Windows Scripting Engine Type Confusion Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
Commvault Web Server Unspecified Vulnerability
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Commvault Command Center Path Traversal Vulnerability
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434…
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Google Chromium Mojo Sandbox Escape Vulnerability
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
Microsoft Windows NTFS Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
Microsoft Windows Win32k Use-After-Free Vulnerability
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Microsoft Windows Storage Link Following Vulnerability
Windows Storage Elevation of Privilege Vulnerability
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
Microsoft Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
Microsoft Windows Management Console Remote Code Execution Vulnerability
Microsoft Management Console Remote Code Execution Vulnerability
Microsoft Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft Windows Installer Improper Privilege Management Vulnerability
Windows Installer Elevation of Privilege Vulnerability
Kingsoft WPS Office Path Traversal Vulnerability
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability