Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83722 Microsoft US
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-83719 US
Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
EPSS < 0.01 CVE-2026-83715 US
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
EPSS 0.01 CVE-2026-83713 US
Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.
EPSS < 0.01 CVE-2026-83712 US
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83708 US
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83707 US
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83706 US
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
EPSS 0.01 CVE-2026-83705 US
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83704 Microsoft US
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83700 US
Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83699 US
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-83693 US
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83694 US
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83692 US
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83691 US
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83690 US
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-83688 US
Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83687 US
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
EPSS < 0.01 CVE-2026-83681 Microsoft US
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83678 US
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83675 US
Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83669 US
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-83671 US
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-83667 US
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83666 US
Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-83658 US
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
EPSS < 0.01 CVE-2026-83657 US
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-83655 US
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83654 US
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83652 US
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83650 US
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-83649 US
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-83648 US
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-83646 US
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83644 US
Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-83642 US
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83641 US
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-83635 US
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83584 US
Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83583 US
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83580 US
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-83578 Microsoft US
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83575 Microsoft US
Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-83571 US
Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-83521 US
Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83518 US
Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-83515 US
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-83516 US
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83510 US
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-83499 US
Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
EPSS < 0.01 CVE-2026-83500 US
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-83504 US
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-81969 US
Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-81964 US
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
EPSS 0.01 CVE-2026-69882 US
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-69718 US
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
EPSS 0.01 CVE-2026-69673 US
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-69633 US
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-69743 US