Being exploited right now.

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Drop everything exploited Code execution OS & kernel Microsoft Windows Server 2012

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Drop everything exploited Injection OS & kernel react-native-community React Native Community Cli

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Drop everything exploited Memory safety OS & kernel Microsoft Windows 10 1607

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Drop everything exploited Other OS & kernel Sudo Project Sudo

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

Drop everything exploited Memory safety OS & kernel Apple macOS

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

exploited Code execution OS & kernel Microsoft Windows 10 1507

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

exploited Auth & access OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

exploited Crypto OS & kernel Linux Kernel

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

exploited Other OS & kernel Microsoft Windows 10 1607

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

exploited Other OS & kernel Linux Kernel

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

exploited Other OS & kernel Microsoft Windows 11 23h2

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1607

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

exploited Auth & access OS & kernel Apple macOS

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

exploited Injection OS & kernel Arraynetworks Arrayos Ag

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

exploited Memory safety OS & kernel VMware Esxi

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

exploited Crypto OS & kernel disc-soft Daemon Tools

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

exploited Other OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

exploited Memory safety OS & kernel Linux Kernel

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.

exploited Injection OS & kernel Broadcom Fabric Operating System

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

exploited Code execution OS & kernel Microsoft Windows 10 1507

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

exploited Memory safety OS & kernel Linux Kernel

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

exploited Memory safety OS & kernel VMware Esxi

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

exploited Other OS & kernel Microsoft Windows 10 1507

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

exploited Memory safety OS & kernel Microsoft Windows 10 21h2

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

exploited Auth & access OS & kernel Microsoft Defender Antimalware Platform

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.

exploited Other OS & kernel Microsoft Windows 10 1507

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

exploited Other OS & kernel Microsoft Windows 11 24h2

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

exploited Auth & access OS & kernel Microsoft Windows 10 1607

Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1507

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

exploited Auth & access OS & kernel Microsoft Windows 10 1507

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1809

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

exploited Other OS & kernel Microsoft Windows 10 1607

Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

exploited Other OS & kernel Microsoft Windows 10 1507

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1507

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

exploited Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1809

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

exploited Other OS & kernel Linux Kernel

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

exploited Memory safety OS & kernel Microsoft Windows 10 21h2

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1507

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

exploited Memory safety OS & kernel Microsoft Windows 10 21h2

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

exploited Other OS & kernel Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

exploited Memory safety OS & kernel Linux Kernel

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.

exploited Memory safety OS & kernel Apple Ipados

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

exploited Auth & access OS & kernel Microsoft Windows 10 1607

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1607

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

exploited Crypto OS & kernel Igel Os

Windows Storage Elevation of Privilege Vulnerability

exploited Other OS & kernel Microsoft Windows 10 1507

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

exploited Other OS & kernel Microsoft Windows 10 1809