Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
Affected productsWindows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially cr...
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.
Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems, Windows Server 2012 R2
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows Server 2022 (Server Core installation), Windows 11 Version 23H2 for x64-based Systems
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Affected productsWindows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation)
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Affected productsWindows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 26H2 for ARM64-based Systems
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
Affected productsWindows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 26H2 for ARM64-based Systems
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
Affected productsWindows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Affected productsMicrosoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
Fixed versions17.14.42, 18.10.4, 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Affected productsMicrosoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2021 for 32-bit editions
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Affected productsMicrosoft SharePoint Server Subscription Edition
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.