deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-37133
Published: 2025-10-14
Description: An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37134
Published: 2025-10-14
Description: An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37135
Published: 2025-10-14
Description: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37136
Published: 2025-10-14
Description: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37137
Published: 2025-10-14
Description: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37138
Published: 2025-10-14
Description: An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37139
Published: 2025-10-14
Description: A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-400
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37140
Published: 2025-10-14
Description: Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37141
Published: 2025-10-14
Description: Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37142
Published: 2025-10-14
Description: Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37143
Published: 2025-10-14
Description: An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files through carefully constructed exploits.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37144
Published: 2025-10-14
Description: Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37145
Published: 2025-10-14
Description: Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE: CVE-2025-37146
Published: 2025-10-14
Description: A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US
CVE: CVE-2025-37147
Published: 2025-10-14
Description: A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensure only vendor-signed firmware can execute on the device. An adversary can exploit this vulnerability to run modified or custom firmware on affected Access Points.
CVSS Score: 7.1 (HIGH)
CWE: CWE-290
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US
CVE: CVE-2025-37148
Published: 2025-10-14
Description: A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to potentially disrupt network services and require manual intervention to restore functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US
CVE: CVE-2025-47979
Published: 2025-10-14
Description: Insertion of sensitive information into log file in Windows Failover Cluster allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47979
CVE: CVE-2025-47989
Published: 2025-10-14
Description: Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47989
CVE: CVE-2025-48004
Published: 2025-10-14
Description: Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.4 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48004
CVE: CVE-2025-48813
Published: 2025-10-14
Description: Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-324
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48813
CVE: CVE-2025-49708
Published: 2025-10-14
Description: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49708
CVE: CVE-2025-50152
Published: 2025-10-14
Description: Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50152
CVE: CVE-2025-50174
Published: 2025-10-14
Description: Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50174
CVE: CVE-2025-50175
Published: 2025-10-14
Description: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50175
CVE: CVE-2025-53139
Published: 2025-10-14
Description: Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 7.7 (HIGH)
CWE: CWE-319
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53139
CVE: CVE-2025-53150
Published: 2025-10-14
Description: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53150
CVE: CVE-2025-53717
Published: 2025-10-14
Description: Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-807
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53717
CVE: CVE-2025-53768
Published: 2025-10-14
Description: Use after free in Xbox allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53768
CVE: CVE-2025-53782
Published: 2025-10-14
Description: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-303
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53782
CVE: CVE-2025-54603
Published: 2025-10-14
Description: An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://claroty.com; https://claroty.com/product-security/oidc-configurations-in-claroty-secure-access
CVE: CVE-2025-55240
Published: 2025-10-14
Description: Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55240
CVE: CVE-2025-55247
Published: 2025-10-14
Description: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55247
CVE: CVE-2025-55248
Published: 2025-10-14
Description: Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-326
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55248
CVE: CVE-2025-55315
Published: 2025-10-14
Description: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-444
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315; https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/; https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040
CVE: CVE-2025-55320
Published: 2025-10-14
Description: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55320
CVE: CVE-2025-55325
Published: 2025-10-14
Description: Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55325
CVE: CVE-2025-55326
Published: 2025-10-14
Description: Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55326
CVE: CVE-2025-55328
Published: 2025-10-14
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55328
CVE: CVE-2025-55330
Published: 2025-10-14
Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-841
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55330
CVE: CVE-2025-55331
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55331
CVE: CVE-2025-55332
Published: 2025-10-14
Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-841
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55332
CVE: CVE-2025-55333
Published: 2025-10-14
Description: Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1023
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55333
CVE: CVE-2025-55334
Published: 2025-10-14
Description: Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-312
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55334
CVE: CVE-2025-55335
Published: 2025-10-14
Description: Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.4 (HIGH)
CWE: CWE-362, CWE-416, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55335
CVE: CVE-2025-55336
Published: 2025-10-14
Description: Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55336
CVE: CVE-2025-55337
Published: 2025-10-14
Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-841
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55337
CVE: CVE-2025-55338
Published: 2025-10-14
Description: Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1310, CWE-288
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55338
CVE: CVE-2025-55339
Published: 2025-10-14
Description: Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55339
CVE: CVE-2025-55340
Published: 2025-10-14
Description: Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55340
CVE: CVE-2025-55676
Published: 2025-10-14
Description: Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55676
CVE: CVE-2025-55677
Published: 2025-10-14
Description: Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55677
CVE: CVE-2025-55678
Published: 2025-10-14
Description: Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55678
CVE: CVE-2025-55679
Published: 2025-10-14
Description: Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20, CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55679
CVE: CVE-2025-55680
Published: 2025-10-14
Description: Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55680
CVE: CVE-2025-55681
Published: 2025-10-14
Description: Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-125, CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55681
CVE: CVE-2025-55682
Published: 2025-10-14
Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-841
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55682
CVE: CVE-2025-55683
Published: 2025-10-14
Description: Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55683
CVE: CVE-2025-55684
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55684
CVE: CVE-2025-55685
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55685
CVE: CVE-2025-55686
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55686
CVE: CVE-2025-55687
Published: 2025-10-14
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Resilient File System (ReFS) allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.4 (HIGH)
CWE: CWE-362, CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55687
CVE: CVE-2025-55688
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55688
CVE: CVE-2025-55689
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55689
CVE: CVE-2025-55690
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55690
CVE: CVE-2025-55691
Published: 2025-10-14
Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55691
CVE: CVE-2025-55692
Published: 2025-10-14
Description: Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55692
CVE: CVE-2025-55693
Published: 2025-10-14
Description: Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.4 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55693
CVE: CVE-2025-55694
Published: 2025-10-14
Description: Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55694
CVE: CVE-2025-55695
Published: 2025-10-14
Description: Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55695
CVE: CVE-2025-55696
Published: 2025-10-14
Description: Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55696