Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows Server 2025 (Server Core installation), Windows 11 Version 26H1 for ARM64-based Systems
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation)
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Affected productsMicrosoft Visual Studio 2026 version 18.10, Microsoft Visual Studio 2022 version 17.14, ASP.NET Core 8.0, ASP.NET Core 10.0
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
Affected productsMicrosoft SQL Server 2017 for x64-based Systems (CU31), Microsoft SQL Server 2019 for x64-based Systems (CU32), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2017 for x64-based Systems (GDR)
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
Affected productsMicrosoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (CU32)
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
Affected productsMicrosoft SQL Server 2019 for x64-based Systems (CU32), Microsoft SQL Server 2022 for x64-based Systems (CU27), Microsoft SQL Server 2025 for x64-based Systems (CU9), Microsoft SQL Server 2019 for x64-based Systems (GDR)
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
Affected productsMicrosoft SQL Server 2017 for x64-based Systems (CU31), Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2025 for x64-based Systems (GDR)
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
Affected productsMicrosoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2022 for x64-based Systems (CU27), Microsoft SQL Server 2025 for x64-based Systems (CU9)
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
Affected productsMicrosoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (CU32)
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
Affected productsMicrosoft SQL Server 2017 for x64-based Systems (CU31), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR)
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for x64-based Systems, Windows 11 Version 26H2 for ARM64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems
Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Affected productsMicrosoft Configuration Manager 2503, Microsoft Configuration Manager 2509, Microsoft Configuration Manager 2603
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.
Affected productsWindows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016, Windows Server 2016 (Server Core installation)
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.