Consulta vulnerabilidades CVE, conoce su impacto y verifica las medidas de corrección en fuentes oficiales.
CVE
Riesgo
KB asociado
Descripcion del KB
Fecha de liberacion
CVE-2025-10263
Critical
KB5095051
5095051
09/06/2026
CVE-2025-10263
Critical
N/D
No cwe for this issue in Windows Kernel allows an unauthorized attacker to elevate privileges locally. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. How could an attacker exploit this vulnerability?
An attacker could exploit this issue by triggering a specific timing condition during a memory permission change, causing a memory write to be applied using outdated permissions. Under these conditions, a write from a lower‑privileged context could succeed even after access should have been restricted.
09/06/2026
CVE-2025-10263
Critical
KB5094127
5094127
09/06/2026
CVE-2025-10263
Critical
KB5094126
5094126
09/06/2026
CVE-2025-10263
Critical
KB5093998
5093998
09/06/2026
CVE-2026-26142
Critical
N/D
Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.
09/06/2026
CVE-2026-32174
Critical
N/D
Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
09/06/2026
CVE-2026-32193
Critical
N/D
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally. How could an attacker exploit this vulnerability?
An attacker who can run an untrusted container configured with hostNetwork could send specially crafted requests to a host‑level service that was not intended for unauthenticated access. This could allow the attacker to break out of the container and gain control of the AKS worker node. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
09/06/2026
CVE-2026-32208
Critical
N/D
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
09/06/2026
CVE-2026-33828
Critical
KB5094123
5094123
09/06/2026
CVE-2026-33828
Critical
N/D
Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
09/06/2026
CVE-2026-33828
Critical
KB5094128
5094128
09/06/2026
CVE-2026-33828
Critical
KB5094127
5094127
09/06/2026
CVE-2026-33828
Critical
KB5094125
5094125
09/06/2026
CVE-2026-33828
Critical
KB5094126
5094126
09/06/2026
CVE-2026-33828
Critical
KB5093998
5093998
09/06/2026
CVE-2026-33828
Critical
KB5095051
5095051
09/06/2026
CVE-2026-33828
Critical
KB5094122
5094122
09/06/2026
CVE-2026-34182
Critical
N/D
N/D
09/06/2026
CVE-2026-42824
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
09/06/2026
CVE-2026-42895
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
09/06/2026
CVE-2026-42985
Critical
N/D
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. How could an attacker exploit this vulnerability?
In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.
09/06/2026
CVE-2026-42985
Critical
KB5094123
5094123
09/06/2026
CVE-2026-42985
Critical
KB5094128
5094128
09/06/2026
CVE-2026-42985
Critical
KB5094127
5094127
09/06/2026
CVE-2026-42985
Critical
KB5094125
5094125
09/06/2026
CVE-2026-42985
Critical
KB5094126
5094126
09/06/2026
CVE-2026-42985
Critical
KB5093998
5093998
09/06/2026
CVE-2026-42985
Critical
KB5095051
5095051
09/06/2026
CVE-2026-42985
Critical
KB5094122
5094122
09/06/2026
CVE-2026-42985
Critical
KB5094042
5094042
09/06/2026
CVE-2026-42985
Critical
KB5094041
5094041
09/06/2026
CVE-2026-42987
Critical
KB5094123
5094123
09/06/2026
CVE-2026-42987
Critical
N/D
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition. How could an attacker exploit this vulnerability?
An attacker could send specially crafted network requests to a Windows Server system that has the Windows Deployment Services (WDS) role enabled and is listening for TFTP traffic. By triggering an error in how the server handles simultaneous requests, an unauthenticated remote attacker could cause the service to use invalid memory, which could allow the attacker to run code on the affected server.
09/06/2026
CVE-2026-42987
Critical
KB5094128
5094128
09/06/2026
CVE-2026-42987
Critical
KB5094125
5094125
09/06/2026
CVE-2026-42987
Critical
KB5094122
5094122
09/06/2026
CVE-2026-42987
Critical
KB5094042
5094042
09/06/2026
CVE-2026-42987
Critical
KB5094041
5094041
09/06/2026
CVE-2026-42992
Critical
KB5094123
5094123
09/06/2026
CVE-2026-42992
Critical
N/D
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. How could an attacker exploit this vulnerability?
In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.
09/06/2026
CVE-2026-42992
Critical
KB5094128
5094128
09/06/2026
CVE-2026-42992
Critical
KB5094127
5094127
09/06/2026
CVE-2026-42992
Critical
KB5094125
5094125
09/06/2026
CVE-2026-42992
Critical
KB5094126
5094126
09/06/2026
CVE-2026-42992
Critical
KB5093998
5093998
09/06/2026
CVE-2026-42992
Critical
KB5095051
5095051
09/06/2026
CVE-2026-42992
Critical
KB5094122
5094122
09/06/2026
CVE-2026-44799
Critical
KB5094123
5094123
09/06/2026
CVE-2026-44799
Critical
N/D
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. How could an attacker exploit this vulnerability?
In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.
09/06/2026
412
Visitas totales
164
Visitantes únicos