Filtered by vendor Microsoft Subscriptions
Filtered by product Windows Subscriptions
Total 9492 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-33231 2 Microsoft, Nvidia 2 Windows, Cuda Toolkit 2026-02-26 6.7 Medium
NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path element by exploiting insecure DLL search paths. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service and information disclosure.
CVE-2023-5528 4 Fedoraproject, Kubernetes, Microsoft and 1 more 4 Fedora, Kubernetes, Windows and 1 more 2026-02-25 7.2 High
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVE-2022-34883 3 Docker, Hitachi, Microsoft 3 Docker, Raid Manager Storage Replication Adapter, Windows 2026-02-25 7.2 High
OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrary OS commands. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02 on Windows; 02.05.00 versions prior to 02.05.01 on Windows and Docker.
CVE-2022-34882 3 Docker, Hitachi, Microsoft 3 Docker, Raid Manager Storage Replication Adapter, Windows 2026-02-25 9 Critical
Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensitive information. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02 on Windows; 02.05.00 versions prior to 02.05.01 on Windows and Docker.
CVE-2023-47041 3 Adobe, Apple, Microsoft 3 Media Encoder, Macos, Windows 2026-02-25 7.8 High
Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-47042 3 Adobe, Apple, Microsoft 3 Media Encoder, Macos, Windows 2026-02-25 7.8 High
Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-47046 3 Adobe, Apple, Microsoft 3 Audition, Macos, Windows 2026-02-25 5.5 Medium
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2018-20029 3 Dokan-dev, Microsoft, Nomachine 3 Dokany, Windows, Nomachine 2026-02-25 5.5 Medium
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read.
CVE-2022-22528 2 Microsoft, Sap 2 Windows, Adaptive Server Enterprise 2026-02-24 7.8 High
SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certain conditions, allows a Standard User to execute malicious Windows binaries which may lead to privilege escalation on the local system. The issue is with the ASE installer and does not impact other ASE binaries.
CVE-2022-1316 2 Microsoft, Zerotier 2 Windows, Zerotierone 2026-02-24 8.8 High
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
CVE-2021-36958 1 Microsoft 18 Windows, Windows 10 1507, Windows 10 1607 and 15 more 2026-02-24 7.8 High
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
CVE-2026-25766 2 Labstack, Microsoft 2 Echo, Windows 2026-02-23 5.3 Medium
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.
CVE-2019-2390 2 Microsoft, Mongodb 2 Windows, Mongodb 2026-02-23 8.2 High
An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.
CVE-2023-0213 2 M-files, Microsoft 2 M-files, Windows 2026-02-23 8.8 High
Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.
CVE-2025-59289 1 Microsoft 19 Windows, Windows 10, Windows 10 21h2 and 16 more 2026-02-22 7 High
Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVE-2025-59278 1 Microsoft 28 Windows, Windows 10, Windows 10 1507 and 25 more 2026-02-22 7.8 High
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59275 1 Microsoft 28 Windows, Windows 10, Windows 10 1507 and 25 more 2026-02-22 7.8 High
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59261 1 Microsoft 16 Graphics Component, Windows, Windows 11 and 13 more 2026-02-22 7 High
Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-59253 1 Microsoft 28 Windows, Windows 10, Windows 10 1507 and 25 more 2026-02-22 5.5 Medium
Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
CVE-2025-59244 1 Microsoft 28 Windows, Windows 10, Windows 10 1507 and 25 more 2026-02-22 6.5 Medium
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.