Microsoft
Microsoft Windows 10 1507: vulnerabilidades y CVE
Microsoft Windows 10 1507 tiene 1230 vulnerabilidades publicadas, 65 de ellas en los últimos 12 meses. 34 son críticas y 132 figuran en el catálogo de explotación activa de CISA.
CVE1230
Últimos 12 meses65
Críticas34
Explotadas activamente132
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-36424 | Alta (7.8) | 12% | ⚠ Explotación activa | 14 nov 2023 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2025-33073 | Alta (8.8) | 83% | ⚠ Explotación activa | 10 jun 2025 | Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-59230 | Alta (7.8) | 2.7% | ⚠ Explotación activa | 14 oct 2025 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2025-24990 | Alta (7.8) | 6.4% | ⚠ Explotación activa | 14 oct 2025 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver… |
| CVE-2025-47827 | Media (4.6) | 4.9% | ⚠ Explotación activa | 5 jun 2025 | In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS… |
| CVE-2021-43226 | Alta (7.8) | 3.1% | ⚠ Explotación activa | 15 dic 2021 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2025-33053 | Alta (8.8) | 87% | ⚠ Explotación activa | 10 jun 2025 | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
| CVE-2025-30397 | Alta (7.5) | 27% | ⚠ Explotación activa | 13 may 2025 | Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network. |
| CVE-2025-32709 | Alta (7.8) | 2.1% | ⚠ Explotación activa | 13 may 2025 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2025-32706 | Alta (7.8) | 2.3% | ⚠ Explotación activa | 13 may 2025 | Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-32701 | Alta (7.8) | 1.4% | ⚠ Explotación activa | 13 may 2025 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-24054 | Media (5.4) | 59% | ⚠ Explotación activa | 11 mar 2025 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-29824 | Alta (7.8) | 14% | ⚠ Explotación activa | 8 abr 2025 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-24984 | Media (4.6) | 2.0% | ⚠ Explotación activa | 11 mar 2025 | Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2025-26633 | Alta (7) | 30% | ⚠ Explotación activa | 11 mar 2025 | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2025-24991 | Media (5.5) | 2.0% | ⚠ Explotación activa | 11 mar 2025 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
| CVE-2025-24985 | Alta (7.8) | 3.8% | ⚠ Explotación activa | 11 mar 2025 | Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. |
| CVE-2025-24993 | Alta (7.8) | 2.2% | ⚠ Explotación activa | 11 mar 2025 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
| CVE-2025-24983 | Alta (7) | 1.3% | ⚠ Explotación activa | 11 mar 2025 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| CVE-2018-8639 | Alta (7.8) | 22% | ⚠ Explotación activa | 12 dic 2018 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-64680 | Alta (7.8) | 0.37% | — | 9 dic 2025 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
| CVE-2025-64679 | Alta (7.8) | 0.45% | — | 9 dic 2025 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
| CVE-2025-62209 | Media (5.5) | 0.52% | — | 11 nov 2025 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
| CVE-2025-62208 | Media (5.5) | 0.52% | — | 11 nov 2025 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
| CVE-2025-59295 | Alta (8.8) | 1.9% | — | 14 oct 2025 | Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network. |
| CVE-2025-59294 | Media (4.6) | 0.63% | — | 14 oct 2025 | Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2025-59282 | Alta (7) | 0.61% | — | 14 oct 2025 | Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
| CVE-2025-59280 | Baja (3.1) | 0.46% | — | 14 oct 2025 | Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network. |
| CVE-2025-59278 | Alta (7.8) | 0.27% | — | 14 oct 2025 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59277 | Alta (7.8) | 0.38% | — | 14 oct 2025 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59275 | Alta (7.8) | 0.27% | — | 14 oct 2025 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59259 | Media (6.5) | 1.5% | — | 14 oct 2025 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
| CVE-2025-59254 | Alta (7.8) | 1.1% | — | 14 oct 2025 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59253 | Media (5.5) | 0.34% | — | 14 oct 2025 | Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
| CVE-2025-59244 | Media (6.5) | 0.82% | — | 14 oct 2025 | External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-59242 | Alta (7.8) | 0.41% | — | 14 oct 2025 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59230 | Alta (7.8) | 2.7% | ⚠ Explotación activa | 14 oct 2025 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59214 | Media (6.5) | 1.8% | — | 14 oct 2025 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-59211 | Media (5.5) | 0.61% | — | 14 oct 2025 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
| CVE-2025-59209 | Media (5.5) | 0.47% | — | 14 oct 2025 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
| CVE-2025-59208 | Alta (7.1) | 0.50% | — | 14 oct 2025 | Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-59205 | Alta (7) | 0.20% | — | 14 oct 2025 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59203 | Media (5.5) | 0.45% | — | 14 oct 2025 | Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally. |
| CVE-2025-59201 | Alta (7.8) | 0.45% | — | 14 oct 2025 | Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59200 | Alta (7.7) | 0.80% | — | 14 oct 2025 | Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally. |
| CVE-2025-59198 | Media (5) | 0.47% | — | 14 oct 2025 | Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
| CVE-2025-59197 | Media (5.5) | 0.45% | — | 14 oct 2025 | Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally. |
| CVE-2025-59196 | Alta (7) | 0.26% | — | 14 oct 2025 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59192 | Alta (7.8) | 0.29% | — | 14 oct 2025 | Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-59190 | Media (5.5) | 0.50% | — | 14 oct 2025 | Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.