Operating system kernel and driver vulnerabilities (exploited-in-the-wild focus).
CVE-2026-68820 is a use-after-free (CWE-416) in Microsoft's Windows Ancillary Function Driver for WinSock that lets an authorized attacker elevate privileges locally. Rated 7.0 HIGH (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and listed in CISA's KEV catalog.
CVE-2026-53362 is a KEV-listed, unspecified out-of-bounds write (CWE-787) in the Linux kernel's IPv6 networking subsystem enabling local privilege escalation, scored 7.8 on CVSS 3.1. Affected versions are not disclosed; kernel.org stable commit references and…
A CWE-669 incorrect resource transfer between spheres flaw in the Linux kernel that could allow local privilege escalation. CVSS 7.8 (High), listed in CISA's KEV catalog, with eight stable-tree fix commits referenced.
CVE-2025-32701 is a use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver that allows an authorized attacker to elevate privileges locally. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
Microsoft Windows Ancillary Function Driver for WinSock (AFD.sys) contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
CVE-2023-0386 is a local privilege escalation vulnerability in the Linux kernel's OverlayFS subsystem caused by improper ownership management when copying a capable file from a nosuid mount into another mount, allowing unauthorized execution of…
CVE-2025-38352 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Linux kernel with high impact on confidentiality, integrity, and availability. It is listed in the Known Exploited Vulnerabilities catalog.
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
CVE-2025-24990 is an untrusted pointer dereference vulnerability in the Microsoft Windows Agere Modem Driver that enables local privilege escalation to administrator level. It is listed in CISA's Known Exploited Vulnerabilities catalog.
Microsoft Windows SMB Client contains an improper access control vulnerability allowing privilege escalation. An attacker can execute a malicious script to coerce a victim machine into connecting back to the attacker's system via SMB…