Filtered by vendor Microsoft Subscriptions
Filtered by product Windows 10 Subscriptions
Total 4233 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-60707 1 Microsoft 20 Windows, Windows 10, Windows 10 1809 and 17 more 2025-11-19 7.8 High
Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.
CVE-2025-60706 1 Microsoft 23 Hyper-v, Windows, Windows 10 and 20 more 2025-11-19 5.5 Medium
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.
CVE-2025-60705 1 Microsoft 27 Windows, Windows 10, Windows 10 1607 and 24 more 2025-11-19 7.8 High
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
CVE-2025-60704 1 Microsoft 27 Windows, Windows 10, Windows 10 1607 and 24 more 2025-11-19 7.5 High
Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-60703 1 Microsoft 28 Remote, Remote Desktop, Windows and 25 more 2025-11-19 7.8 High
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
CVE-2025-59513 1 Microsoft 25 Windows, Windows 10, Windows 10 1607 and 22 more 2025-11-19 5.5 Medium
Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally.
CVE-2025-59512 1 Microsoft 24 Windows, Windows 10, Windows 10 1607 and 21 more 2025-11-19 7.8 High
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.
CVE-2025-59511 1 Microsoft 20 Windows, Windows 10, Windows 10 1809 and 17 more 2025-11-19 7.8 High
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.
CVE-2025-59510 1 Microsoft 25 Remote, Windows, Windows 10 and 22 more 2025-11-19 5.5 Medium
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.
CVE-2025-59509 1 Microsoft 20 Windows, Windows 10, Windows 10 1809 and 17 more 2025-11-19 5.5 Medium
Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.
CVE-2025-59508 1 Microsoft 22 Windows, Windows 10, Windows 10 1607 and 19 more 2025-11-19 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.
CVE-2025-59507 1 Microsoft 22 Windows, Windows 10, Windows 10 1607 and 19 more 2025-11-19 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.
CVE-2025-59506 1 Microsoft 24 Windows, Windows 10, Windows 10 1607 and 21 more 2025-11-19 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.
CVE-2025-59505 1 Microsoft 24 Windows, Windows 10, Windows 10 1607 and 21 more 2025-11-19 7.8 High
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVE-2025-24990 1 Microsoft 30 Windows, Windows 10, Windows 10 1507 and 27 more 2025-11-18 7.8 High
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
CVE-2018-4878 6 Adobe, Apple, Google and 3 more 11 Flash Player, Macos, Chrome Os and 8 more 2025-11-18 7.8 High
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
CVE-2018-5002 6 Adobe, Apple, Google and 3 more 12 Flash Player, Flash Player Desktop Runtime, Mac Os X and 9 more 2025-11-18 7.8 High
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2016-4171 8 Adobe, Apple, Google and 5 more 15 Flash Player, Mac Os X, Macos and 12 more 2025-11-17 7.8 High
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVE-2016-1019 6 Adobe, Apple, Google and 3 more 14 Air Desktop Runtime, Air Sdk, Air Sdk \& Compiler and 11 more 2025-11-17 7.8 High
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVE-2025-59033 1 Microsoft 7 Windows, Windows 10, Windows 11 and 4 more 2025-11-17 7.4 High
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.