Windows 10 1607
by Microsoft
CVEs (3,413)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-21508 | 0.00 | — | 0.00 | Feb 10, 2026 | Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-21236 | 0.00 | — | 0.00 | Feb 10, 2026 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-21234 | 0.00 | — | 0.00 | Feb 10, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-21235 | 0.00 | — | 0.01 | Feb 10, 2026 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-21242 | 0.00 | — | 0.00 | Feb 10, 2026 | Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-21246 | 0.00 | — | 0.00 | Feb 10, 2026 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-21247 | 0.00 | — | 0.01 | Feb 10, 2026 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. | |||
| CVE-2026-20939 | 0.00 | — | 0.00 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | |||
| CVE-2026-20937 | 0.00 | — | 0.00 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | |||
| CVE-2026-20936 | 0.00 | — | 0.00 | Jan 13, 2026 | Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack. | |||
| CVE-2026-20929 | 0.00 | — | 0.01 | Jan 13, 2026 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. | |||
| CVE-2026-20874 | 0.00 | — | 0.00 | Jan 13, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-20873 | 0.00 | — | 0.00 | Jan 13, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-20872 | 0.00 | — | 0.19 | Jan 13, 2026 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | |||
| CVE-2026-20871 | 0.00 | — | 0.04 | Jan 13, 2026 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-20868 | 0.00 | — | 0.01 | Jan 13, 2026 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. | |||
| CVE-2026-20867 | 0.00 | — | 0.00 | Jan 13, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-20866 | 0.00 | — | 0.00 | Jan 13, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | |||
| CVE-2026-20862 | 0.00 | — | 0.01 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally. | |||
| CVE-2026-20861 | 0.00 | — | 0.00 | Jan 13, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. |
- CVE-2026-21508Feb 10, 2026risk 0.00cvss —epss 0.00
Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-21236Feb 10, 2026risk 0.00cvss —epss 0.00
Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- CVE-2026-21234Feb 10, 2026risk 0.00cvss —epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-21235Feb 10, 2026risk 0.00cvss —epss 0.01
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-21242Feb 10, 2026risk 0.00cvss —epss 0.00
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- CVE-2026-21246Feb 10, 2026risk 0.00cvss —epss 0.00
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-21247Feb 10, 2026risk 0.00cvss —epss 0.01
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.
- CVE-2026-20939Jan 13, 2026risk 0.00cvss —epss 0.00
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- CVE-2026-20937Jan 13, 2026risk 0.00cvss —epss 0.00
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- CVE-2026-20936Jan 13, 2026risk 0.00cvss —epss 0.00
Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.
- CVE-2026-20929Jan 13, 2026risk 0.00cvss —epss 0.01
Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
- CVE-2026-20874Jan 13, 2026risk 0.00cvss —epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20873Jan 13, 2026risk 0.00cvss —epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20872Jan 13, 2026risk 0.00cvss —epss 0.19
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-20871Jan 13, 2026risk 0.00cvss —epss 0.04
Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.
- CVE-2026-20868Jan 13, 2026risk 0.00cvss —epss 0.01
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CVE-2026-20867Jan 13, 2026risk 0.00cvss —epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20866Jan 13, 2026risk 0.00cvss —epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20862Jan 13, 2026risk 0.00cvss —epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally.
- CVE-2026-20861Jan 13, 2026risk 0.00cvss —epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Page 119 of 171