Patch TuesdayMicrosoft's monthly security release, by update and product, as the Security Update Guide states it. Nothing is generated.
Your Windows releases from the fleet
- Windows 11, version 26H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711)
- Windows 11, version 25H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711), KB5124008 (20 CVEs · build 10.0.26200.9445), KB5101650 (2 CVEs · build 10.0.26200.8875)
- Windows 11, version 24H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711), KB5124008 (20 CVEs · build 10.0.26200.9445), KB5101650 (2 CVEs · build 10.0.26200.8875)
- Windows 11, version 23H2 — KB5126653 (965 CVEs, 1 exploited · build 10.0.22631.7652), KB5122880 (9 CVEs · build 10.0.22631.7582), KB5099414 (1 CVEs · build 10.0.22631.7376)
By update 150 in October 2026
| Update | Products | CVEs | Critical | Exploited |
|---|---|---|---|---|
| KB5127648 · 10.0.26100.9711 | Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 26H2 | 3025 | 75 | 3 |
| KB5126657 · 10.0.19044.7807 | Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 | 1798 | 44 | 2 |
| KB5126646 · 10.0.26100.33650 | Windows Server 2025, Windows Server 2025 (Server Core installation) | 1041 | 35 | 1 |
| KB5127646 · 10.0.28000.3231 | Windows 11 Version 26H1, Windows 11 version 26H1 | 997 | 25 | 1 |
| KB5126655 · 10.0.20348.5761 | Windows Server 2022, Windows Server 2022 (Server Core installation) | 977 | 33 | 1 |
| KB5126653 · 10.0.22631.7652 | Windows 11 Version 23H2 | 965 | 25 | 1 |
| KB5126651 · 10.0.17763.9376 | Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation) | 918 | 30 | 1 |
| KB5126868 · 10.0.14393.9612 | Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 | 770 | 27 | 1 |
| KB5126836 · 6.3.9600.23470 | Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | 649 | 23 | 1 |
| Release Notes · 20260925.100 | Outlook.com, azl3 brotli 1.1.0-2 on Azure Linux 3.0, azl3 nodejs 24.21.0-1 on Azure Linux 3.0, Raw Image Extension on Windows 10 Version 1607, Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems, Raw Image Extension on Windows 10 and 28 more | 23 | 8 | 1 |
| Release Notes · 154.0.4258.62 | Microsoft Edge (Chromium-based) | 19 | 2 | 1 |
| KB5126835 · 6.2.9200.26434 | Windows Server 2012, Windows Server 2012 (Server Core installation) | 612 | 21 | |
| Release Notes · 16.0.14334.20974 | Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions | 310 | 68 | |
| Release Notes · https://aka.ms/OfficeSecurityReleases | Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft 365 Apps for Enterprise for 32-bit Systems | 162 | 37 | |
| Release Notes · 16.114.26101123 | Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft Office 365 for Mac | 114 | 30 | |
| Release Notes · 18.11.2 | Microsoft Visual Studio 2026 version 18.11, Microsoft Visual Studio 2026 version 18.12, Microsoft Visual Studio 2026 version 18.10 | 51 | 4 | |
| Release Notes · 17.14.43 | Microsoft Visual Studio 2022 version 17.14 | 46 | 3 | |
| KB5002928 · 16.0.10417.20228 | Office Online Server | 44 | 13 | |
| KB5002927 · 16.0.20326.20190 | Microsoft SharePoint Server Subscription Edition | 36 | 2 | |
| Release Notes · 11.0.100-rc.3.26522.148 | .NET 11.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, .NET 11.0 runtime installed on Windows, ASP.NET Core 11.0, .NET 11.0 runtime installed on Linux and 1 more | 34 | 2 | |
| KB5130035 · 9.0.21 | .NET 9.0 runtime installed on Windows, ASP.NET Core 9.0, .NET 9.0 runtime installed on Mac OS, .NET 9.0 runtime installed on Linux | 32 | 1 | |
| KB5130036 · 10.0.13 | ASP.NET Core 10.0, .NET 10.0 runtime installed on Windows, .NET 10.0 runtime installed on Mac OS, .NET 10.0 runtime installed on Linux | 32 | ||
| KB5130034 · 8.0.32 | .NET 8.0 runtime installed on Windows, ASP.NET Core 8.0, .NET 8.0 runtime installed on Mac OS, .NET 8.0 runtime installed on Linux | 29 | 1 | |
| KB5126934 · 16.0.4305.5 | Microsoft SQL Server 2022 for x64-based Systems (CU27) | 21 | ||
| KB5126967 · 17.0.5015.4 | Microsoft SQL Server 2025 for x64-based Systems (CU9) | 21 | ||
| KB5128492 · 17.0.1145.4 | Microsoft SQL Server 2025 for x64-based Systems (GDR) | 21 | ||
| KB5128493 · 16.0.1210.3 | Microsoft SQL Server 2022 for x64-based Systems (GDR) | 21 | ||
| KB5124008 · 10.0.26200.9445 | Windows 11 Version 25H2, Windows 11 Version 24H2 | 20 | 2 | |
| KB5128494 · 15.0.4500.2 | Microsoft SQL Server 2019 for x64-based Systems (CU32) | 19 | ||
| KB5128495 · 15.0.2200.2 | Microsoft SQL Server 2019 for x64-based Systems (GDR) | 19 | ||
| KB5127666 · 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809 | 18 | 1 | |
| KB5127689 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2 | 18 | 1 | |
| KB5127690 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 | 18 | 1 | |
| KB5127691 · 4.8.9363.0 | Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1 | 18 | 1 | |
| KB5127692 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2 | 18 | 1 | |
| KB5127693 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022 | 18 | 1 | |
| KB5127667 · 4.7.4150.0 | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 | 17 | 1 | |
| KB5127668 · 4.7.4150.0 | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 | 17 | 1 | |
| KB5127685 · 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 | 17 | 1 | |
| KB5127687 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 | Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 | 17 | 1 |
110 more updates, mostly single products; the CVE table below names each.
CVEs 3238 of 3238
All components
Mariner 1072Microsoft Edge (Chromium-based) 704Microsoft Office Excel 70Role: DNS Server 52Windows Kernel 46Microsoft Office Word 45Windows Installer 38Microsoft Office SharePoint 37Windows Win32 Kernel Subsystem 36Microsoft Windows Search Component 29.NET 27Windows NTFS 26SQL Server 22Windows Error Reporting 22
| CVE | Severity | CVSS | Component | Title | Update |
|---|---|---|---|---|---|
| CVE-2026-96951exploited | Important | 8.8 | Windows Shell | Windows Shell Security Feature Bypass Vulnerability | KB5126836, KB5126868, KB5126651 +11 |
| CVE-2026-111497disclosed | Critical | 8.1 | .NET | Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder | Release Notes, KB5133964, KB5133965 +10 |
| CVE-2026-108398disclosed | Important | 8.8 | .NET Framework | .NET Framework Security Feature Bypass Vulnerability | KB5126868, KB5127666, KB5127685 +13 |
| CVE-2026-92707disclosed | Moderate | 5.3 | .NET | MessagePack-CSharp Denial of Service Vulnerability | Release Notes, Release Notes, Release Notes +5 |
| CVE-2026-110063 | Critical | 10.0 | VM Inspector for Azure Virtual Machines | VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability | |
| CVE-2026-110264 | Critical | 10.0 | Mariner (GitLab) | Integer Overflow or Wraparound in GitLab | Release Notes |
| CVE-2026-83938 | Critical | 10.0 | Azure Kubernetes Configuration Service | Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability | |
| CVE-2026-94603 | Critical | 10.0 | Mariner (GitHub_M) | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation | |
| CVE-2026-96207 | Critical | 10.0 | Microsoft Partner Center | Microsoft Partner Center Elevation of Privilege Vulnerability | |
| CVE-2026-97229 | Critical | 10.0 | Mariner (GitLab) | Integer Overflow or Wraparound in GitLab | Release Notes, Release Notes |
| CVE-2026-97785 | Critical | 10.0 | AAD App Proxy | AAD App Proxy Elevation of Privilege Vulnerability | |
| CVE-2026-115384 | Critical | 9.9 | Mariner (VulnCheck) | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow | |
| CVE-2026-77524 | Critical | 9.9 | Mariner (GitHub_M) | KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication | Release Notes |
| CVE-2026-94510 | Critical | 9.9 | Microsoft Bookings | Microsoft Bookings Elevation of Privilege Vulnerability | |
| CVE-2026-100202 | Critical | 9.8 | Windows Message Queuing Queue Manager | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-100219 | Critical | 9.8 | Microsoft QUIC | Microsoft QUIC Remote Code Execution Vulnerability | KB5126655, KB5126653, KB5127648 +4 |
| CVE-2026-105016 | Critical | 9.8 | Microsoft QUIC | Microsoft QUIC Remote Code Execution Vulnerability | KB5126655, KB5126653, KB5127648 +10 |
| CVE-2026-111444 | Critical | 9.8 | Mariner (mitre) | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings… | |
| CVE-2026-21413 | Critical | 9.8 | Windows Raw Image Extension | Raw Image Extension Remote Code Execution Vulnerability | Release Notes, Release Notes |
| CVE-2026-56154 | Critical | 9.8 | Mariner (apache) | Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} | Release Notes |
| CVE-2026-56857 | Critical | 9.8 | Mariner (Go) | Root.Mkdir(All) can follow junctions out of the root on Windows in os | |
| CVE-2026-57941 | Critical | 9.8 | Mariner (apache) | Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy | Release Notes |
| CVE-2026-59797 | Critical | 9.8 | Mariner (apache) | Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function | Release Notes |
| CVE-2026-70147 | Critical | 9.8 | Microsoft PostScript Printer Driver | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | KB5127648, KB5127648, KB5127648 +10 |
| CVE-2026-70153 | Critical | 9.8 | Microsoft PostScript Printer Driver | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-70242 | Critical | 9.8 | Microsoft Office Outlook | Microsoft Office Outlook Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-70291 | Critical | 9.8 | Microsoft Office Outlook | Microsoft Office Outlook Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-70300 | Critical | 9.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-77900 | Critical | 9.8 | Azure App Service | Azure App Service Remote Code Execution Vulnerability | |
| CVE-2026-88131 | Critical | 9.8 | Microsoft Dataverse | Microsoft Dataverse Remote Code Execution Vulnerability | |
| CVE-2026-88156 | Critical | 9.8 | Microsoft Office Outlook | Microsoft Office Outlook Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-88178 | Critical | 9.8 | Microsoft Office PowerPoint | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-96934 | Critical | 9.8 | Windows DHCP Server | Windows DHCP Server Remote Code Execution Vulnerability | KB5126836, KB5126868, KB5126651 +3 |
| CVE-2026-97016 | Critical | 9.8 | Microsoft Office Outlook | Microsoft Office Outlook Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-97749 | Critical | 9.8 | Microsoft Office Outlook | Microsoft Office Outlook Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-97814 | Critical | 9.8 | Windows Text Shaping | Windows Text Shaping Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-98167 | Critical | 9.8 | Mariner (Linux) | smb: client: fix server->total_read for compound encrypted PDUs | Release Notes |
| CVE-2026-98168 | Critical | 9.8 | Mariner (Linux) | smb: client: fix reparse buffer bounds in cifs_query_reparse_point() | Release Notes |
| CVE-2026-98170 | Critical | 9.8 | Mariner (Linux) | smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() | |
| CVE-2026-98171 | Critical | 9.8 | Mariner (Linux) | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | Release Notes |
| CVE-2026-98172 | Critical | 9.8 | Mariner (Linux) | smb: client: fix smbd_connection leak on cifs_get_tcp_session() error | Release Notes |
| CVE-2026-98174 | Critical | 9.8 | Mariner (Linux) | smb: client: fix rlist race and missing initialization | Release Notes |
| CVE-2026-98176 | Critical | 9.8 | Mariner (Linux) | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc | |
| CVE-2026-98177 | Critical | 9.8 | Mariner (Linux) | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. | |
| CVE-2026-98179 | Critical | 9.8 | Mariner (Linux) | drm/amdgpu: fix rmmio iounmap skipped on device removal | |
| CVE-2026-98180 | Critical | 9.8 | Mariner (Linux) | drm/msm: RCU-free the scheduler-containing ring and VM objects | |
| CVE-2026-98181 | Critical | 9.8 | Mariner (Linux) | drm/gud: fix out-of-bounds write in gud_plane_atomic_check() | Release Notes |
| CVE-2026-98186 | Critical | 9.8 | Mariner (Linux) | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | Release Notes |
| CVE-2026-98187 | Critical | 9.8 | Mariner (Linux) | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | Release Notes |
| CVE-2026-98188 | Critical | 9.8 | Mariner (Linux) | wifi: p54: validate curve data length in the calibration curve converters | Release Notes |
| CVE-2026-98191 | Critical | 9.8 | Mariner (Linux) | wifi: wlcore: release runtime PM ref on regdomain config failure | Release Notes |
| CVE-2026-98192 | Critical | 9.8 | Mariner (Linux) | wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown | |
| CVE-2026-98193 | Critical | 9.8 | Mariner (Linux) | wifi: libipw: reject TKIP frames without a full MIC | |
| CVE-2026-98199 | Critical | 9.8 | Mariner (Linux) | hwmon: (pmbus/core) increase number of phases and add new mask | Release Notes |
| CVE-2026-98203 | Critical | 9.8 | Mariner (Linux) | Input: soc_button_array - check btns_desc->package.count | Release Notes |
| CVE-2026-98206 | Critical | 9.8 | Mariner (Linux) | Input: cyttsp5 - clamp the HID report size before memcpy | Release Notes |
| CVE-2026-98207 | Critical | 9.8 | Mariner (Linux) | mmc: spi: reset bytes_xfered before retrying CRC failures | Release Notes |
| CVE-2026-98209 | Critical | 9.8 | Mariner (Linux) | mmc: sdhci-of-aspeed: Remove children before releasing SDC resources | Release Notes |
| CVE-2026-98211 | Critical | 9.8 | Mariner (Linux) | mmc: mmci: Fix use-after-free in busy-timeout work | |
| CVE-2026-98212 | Critical | 9.8 | Mariner (Linux) | mmc: hsq: Fix use-after-free in retry work | Release Notes |
| CVE-2026-98214 | Critical | 9.8 | Mariner (Linux) | selinux: recheck intermediate backing files on mprotect() | Release Notes |
| CVE-2026-98215 | Critical | 9.8 | Mariner (Linux) | selinux: preserve user SID across nested backing files | Release Notes |
| CVE-2026-98217 | Critical | 9.8 | Mariner (Linux) | IB/mlx4: Fix use-after-free on pkey sysfs registration failure | Release Notes |
| CVE-2026-98221 | Critical | 9.8 | Mariner (Linux) | KEYS: trusted: Fix tpm2_load_cmd() boundary check | Release Notes |
| CVE-2026-98222 | Critical | 9.8 | Mariner (Linux) | KEYS: encrypted: fix integer overflow of datablob_len | |
| CVE-2026-98232 | Critical | 9.8 | Mariner (Linux) | scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() | Release Notes |
| CVE-2026-98233 | Critical | 9.8 | Mariner (Linux) | net/packet: clear RX owner on VNET header error | Release Notes |
| CVE-2026-98238 | Critical | 9.8 | Mariner (Linux) | net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() | Release Notes |
| CVE-2026-98249 | Critical | 9.8 | Mariner (Linux) | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | Release Notes |
| CVE-2026-98251 | Critical | 9.8 | Mariner (Linux) | openvswitch: avoid reallocating confirmed conntrack labels | Release Notes |
| CVE-2026-98252 | Critical | 9.8 | Mariner (Linux) | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | Release Notes |
| CVE-2026-98253 | Critical | 9.8 | Mariner (Linux) | RDMA/ucma: Serialize join and leave on copy_to_user failure | Release Notes |
| CVE-2026-98254 | Critical | 9.8 | Mariner (Linux) | swiotlb: use the adjusted address for the highmem page lookup | |
| CVE-2026-98255 | Critical | 9.8 | Mariner (Linux) | tcp: exclude old ACKs from tcp fast path | Release Notes |
| CVE-2026-98263 | Critical | 9.8 | Mariner (Linux) | ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type | Release Notes |
| CVE-2026-98269 | Critical | 9.8 | Mariner (Linux) | btrfs: abort transaction on failure to update inode for hole punching and reflinking | Release Notes |
| CVE-2026-98270 | Critical | 9.8 | Mariner (Linux) | drm/amdgpu: check ras and obj before dereference | Release Notes |
| CVE-2026-98272 | Critical | 9.8 | Mariner (Linux) | net: mvpp2: prevent buffer overflow in page_pool allocation | Release Notes |
| CVE-2026-98275 | Critical | 9.8 | Mariner (Linux) | net: ethernet: cortina: Ack RX overrun interrupt correctly | Release Notes |
| CVE-2026-98279 | Critical | 9.8 | Mariner (Linux) | btrfs: handle lack of space when cleaning up verity items | |
| CVE-2026-98282 | Critical | 9.8 | Mariner (Linux) | powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba | Release Notes |
| CVE-2026-98283 | Critical | 9.8 | Mariner (Linux) | KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() | Release Notes |
| CVE-2026-98287 | Critical | 9.8 | Mariner (Linux) | pppoatm: ensure a writable skb header and linear data | Release Notes |
| CVE-2026-98288 | Critical | 9.8 | Mariner (Linux) | net: stmmac: fix TSO header length truncation | |
| CVE-2026-98289 | Critical | 9.8 | Mariner (Linux) | af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). | Release Notes |
| CVE-2026-98292 | Critical | 9.8 | Mariner (Linux) | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access | |
| CVE-2026-98295 | Critical | 9.8 | Mariner (Linux) | Bluetooth: coredump: Quiesce dump work on unregister | |
| CVE-2026-98298 | Critical | 9.8 | Mariner (Linux) | dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() | Release Notes |
| CVE-2026-98301 | Critical | 9.8 | Mariner (Linux) | net: bridge: mst: move switchdev call outside rcu | Release Notes |
| CVE-2026-98303 | Critical | 9.8 | Mariner (Linux) | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | Release Notes |
| CVE-2026-98304 | Critical | 9.8 | Mariner (Linux) | net: bcmgenet: restore the hardware filters on open | |
| CVE-2026-98308 | Critical | 9.8 | Mariner (Linux) | ALSA: hda: trace PCM open only after assigning a stream | Release Notes |
| CVE-2026-98311 | Critical | 9.8 | Mariner (Linux) | wifi: virt_wifi: don't transfer operstate before register | Release Notes |
| CVE-2026-98316 | Critical | 9.8 | Mariner (Linux) | ALSA: bcd2000: Fix race between rawmidi and disconnect | Release Notes |
| CVE-2026-98317 | Critical | 9.8 | Mariner (Linux) | neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. | |
| CVE-2026-98319 | Critical | 9.8 | Mariner (Linux) | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | Release Notes |
| CVE-2026-98320 | Critical | 9.8 | Mariner (Linux) | netfilter: flowtable: hold reference on ct until flow is released | Release Notes |
| CVE-2026-98321 | Critical | 9.8 | Mariner (Linux) | netfilter: nf_nat: unregister and release hooks on error | |
| CVE-2026-98322 | Critical | 9.8 | Mariner (Linux) | netfilter: nft_nat: fully initialise new_addr in netmap setup | Release Notes |
| CVE-2026-98323 | Critical | 9.8 | Mariner (Linux) | RDMA/siw: Bound fragmented header copies by the remaining length | Release Notes |
| CVE-2026-98326 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: mesh: release the channel if start fails | Release Notes |
| CVE-2026-98327 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: mesh: reset the CSA state when leaving | |
| CVE-2026-98328 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: add HE 6 GHz capability in the scan elems len | Release Notes |
| CVE-2026-98329 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: don't allow injecting frames wider than the chanctx | |
| CVE-2026-98330 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: get the wiphy out of a dying network namespace | |
| CVE-2026-98331 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: unlist vifs when their netdev is unregistered | Release Notes |
| CVE-2026-98332 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: only operate on TDLS peers in the TDLS code | |
| CVE-2026-98333 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: reset the LED state when ifup fails | |
| CVE-2026-98335 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: abort chanswitch when leaving a mesh | |
| CVE-2026-98336 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: don't offload TC setup on AP_VLAN interfaces | Release Notes |
| CVE-2026-98337 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: don't start a ROC while scanning | |
| CVE-2026-98338 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: ibss: ref BSS entry for joined event | |
| CVE-2026-98339 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: don't filter by BSS type when removing stale entries | Release Notes |
| CVE-2026-98340 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: only group hidden BSSes with beacon entries | Release Notes |
| CVE-2026-98341 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: don't free driver-owned scan requests | |
| CVE-2026-98345 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: check IP header size in cfg80211_classify8021d() | Release Notes |
| CVE-2026-98348 | Critical | 9.8 | Mariner (Linux) | wifi: libipw: reject too-short association responses | Release Notes |
| CVE-2026-98351 | Critical | 9.8 | Mariner (Linux) | wifi: virt_wifi: free skb when disconnected | Release Notes |
| CVE-2026-98352 | Critical | 9.8 | Mariner (Linux) | RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted | Release Notes |
| CVE-2026-98353 | Critical | 9.8 | Mariner (Linux) | RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables | Release Notes |
| CVE-2026-98362 | Critical | 9.8 | Mariner (Linux) | clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate | Release Notes |
| CVE-2026-98363 | Critical | 9.8 | Mariner (Linux) | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | Release Notes |
| CVE-2026-98365 | Critical | 9.8 | Mariner (Linux) | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access | Release Notes |
| CVE-2026-98368 | Critical | 9.8 | Mariner (Linux) | esp: downgrade zerocopy managed frags before mutating skb frags | Release Notes |
| CVE-2026-98370 | Critical | 9.8 | Mariner (Linux) | xfrm: fix compat ALLOCSPI request use-after-free | Release Notes |
| CVE-2026-99078 | Critical | 9.8 | Mariner (Linux) | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry | |
| CVE-2026-99079 | Critical | 9.8 | Mariner (Linux) | net/mlx5e: Prevent stale XSK buffer release on refill retry | |
| CVE-2026-102331 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102331: Buffer overflow | Release Notes |
| CVE-2026-106197 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106197: Use after free | Release Notes |
| CVE-2026-106358 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106358: Use after free | Release Notes |
| CVE-2026-106382 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106382: Use after free | Release Notes |
| CVE-2026-110136 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110136: Use after free | Release Notes |
| CVE-2026-110149 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110149: Use after free | Release Notes |
| CVE-2026-110152 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110152: Buffer overflow | Release Notes |
| CVE-2026-110161 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110161: Use after free | Release Notes |
| CVE-2026-110165 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110165: Use after free | Release Notes |
| CVE-2026-113072 | Critical | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113072: Memory corruption | Release Notes |
| CVE-2026-69435 | Critical | 9.6 | Azure SRE Agent | Azure SRE Agent Elevation of Privilege Vulnerability | |
| CVE-2026-98573 | Critical | 9.4 | Mariner (Linux) | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | Release Notes |
| CVE-2026-99999 | Critical | 9.3 | Mariner (Linux) | ipv4: validate checksum_start before completing checksum | Release Notes |
| CVE-2026-105014 | Critical | 9.1 | Azure Pipelines | Azure Pipelines Remote Code Execution Vulnerability | |
| CVE-2026-78663 | Critical | 9.1 | Mariner (Go) | Double flow control refund on HTTP/2 server streams in net/http | Release Notes, Release Notes, Release Notes +9 |
| CVE-2026-91403 | Critical | 9.1 | Mariner (oracle) | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0… | |
| CVE-2026-98621 | Critical | 9.1 | Mariner (Linux) | net: gue: reject invalid REMCSUM offsets | Release Notes |
| CVE-2026-98725 | Critical | 9.1 | Mariner (Linux) | nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() | |
| CVE-2026-98794 | Critical | 9.1 | Mariner (Linux) | ipvs: filter some flags received in the backup server | |
| CVE-2026-100209 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-100210 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-100211 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-100220 | Critical | 8.8 | Windows Media Video Decoder | Windows Media Video Decoder Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-102214 | Critical | 8.8 | Windows Hyper-V | Windows Hyper-V Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +8 |
| CVE-2026-102225 | Critical | 8.8 | Windows Text Shaping | Windows Text Shaping Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-102855 | Critical | 8.8 | Microsoft Office Visio | Microsoft Office Visio Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-102856 | Critical | 8.8 | Microsoft Office Visio | Microsoft Office Visio Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-102857 | Critical | 8.8 | Microsoft Office Visio | Microsoft Office Visio Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105718 | Critical | 8.8 | Microsoft Office Excel | Microsoft Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-105733 | Critical | 8.8 | Windows Hyper-V | Windows Hyper-V Remote Code Execution Vulnerability | KB5126657, KB5126657, KB5126655 +6 |
| CVE-2026-106347 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106347: Use after free | Release Notes |
| CVE-2026-108400 | Critical | 8.8 | Microsoft Windows Codecs Library | HEVC Video Extensions Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108439 | Critical | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108440 | Critical | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108467 | Critical | 8.8 | Microsoft PostScript Printer Driver | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-108471 | Critical | 8.8 | Windows Virtualization-Based Security (VBS) Enclave | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | KB5126651 |
| CVE-2026-110148 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110148: Use after free | Release Notes |
| CVE-2026-110151 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110151: Use after free | Release Notes |
| CVE-2026-113271 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113271: Use after free | Release Notes |
| CVE-2026-113279 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113279: Memory corruption | Release Notes |
| CVE-2026-113280 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113280: Memory corruption | Release Notes |
| CVE-2026-113303 | Critical | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113303: Memory corruption | Release Notes |
| CVE-2026-70215 | Critical | 8.8 | Microsoft Office PowerPoint | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-70250 | Critical | 8.8 | Windows DHCP Client | Windows DHCP Client Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-83934 | Critical | 8.8 | Windows GDI+ | Windows GDI+ Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-88073 | Critical | 8.8 | Windows Graphics Kernel | Windows Graphics Kernel Elevation of Privilege Vulnerability | KB5126657, KB5126657, KB5126653 +5 |
| CVE-2026-88144 | Critical | 8.8 | Microsoft Office PowerPoint | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-96202 | Critical | 8.8 | Windows Raw Image Extension | Windows Raw Image Extension Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-96913 | Critical | 8.8 | Windows Kernel | Windows Kernel Elevation of Privilege Vulnerability | KB5127648, KB5127648, KB5127648 +7 |
| CVE-2026-96914 | Critical | 8.8 | Windows Virtualization-Based Security (VBS) Enclave | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | KB5126653, KB5127648, KB5127648 +8 |
| CVE-2026-96943 | Critical | 8.8 | Windows Raw Image Extension | Windows Raw Image Extension Remote Code Execution Vulnerability | Release Notes, Release Notes |
| CVE-2026-96952 | Critical | 8.8 | Microsoft Windows Media Foundation | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | KB5126651, KB5126657, KB5126657 +7 |
| CVE-2026-97739 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-97741 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes |
| CVE-2026-97742 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | KB5002928, Release Notes, Release Notes +2 |
| CVE-2026-97745 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-97753 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | KB5002928, Release Notes, Release Notes +2 |
| CVE-2026-97755 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | KB5002927, Release Notes, Release Notes +3 |
| CVE-2026-97756 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-97758 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-97759 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-97761 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-97765 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | KB5002928, Release Notes, Release Notes +2 |
| CVE-2026-97767 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-97776 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-97778 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | KB5002928, Release Notes, Release Notes +2 |
| CVE-2026-97780 | Critical | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-83943 | Critical | 8.7 | Azure API Center | Azure API Center Information Disclosure Vulnerability | |
| CVE-2026-102866 | Critical | 8.1 | Microsoft Office SharePoint | Microsoft Office SharePoint Elevation of Privilege Vulnerability | KB5002927 |
| CVE-2026-108457 | Critical | 8.1 | Microsoft Windows PDF | Microsoft Windows PDF Remote Code Execution Vulnerability | KB5126653, KB5126657, KB5126657 +2 |
| CVE-2026-108460 | Critical | 8.1 | Windows Message Queuing | Windows Message Queuing Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-69802 | Critical | 8.1 | Network Device Enrollment Service (NDES) | Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-70187 | Critical | 8.1 | Remote Desktop Gateway Service | Windows Remote Desktop Services Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126646 +3 |
| CVE-2026-70229 | Critical | 8.1 | Active Directory Domain Services | Windows Active Directory Domain Services Remote Code Execution Vulnerability | KB5127648, KB5126835, KB5126836 +10 |
| CVE-2026-70269 | Critical | 8.1 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-70571 | Critical | 8.1 | Microsoft Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | KB5128896, KB5128895, KB5128898 +1 |
| CVE-2026-88117 | Critical | 8.1 | Windows DHCP Server | Windows DHCP Server Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-88119 | Critical | 8.1 | Windows DHCP Server | Windows DHCP Server Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-88120 | Critical | 8.1 | Windows DHCP Server | Windows DHCP Server Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-88171 | Critical | 8.1 | Windows DHCP Server | Windows DHCP Server Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126646 +3 |
| CVE-2026-88174 | Critical | 8.1 | Windows Deployment Services | Windows Deployment Services Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126646 +3 |
| CVE-2026-88185 | Critical | 8.1 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-93479 | Critical | 8.1 | Mariner (f5) | NGINX Map directive and Regex matching vulnerability | |
| CVE-2026-100215 | Critical | 7.8 | Microsoft Graphics Component | Microsoft Graphics Component Remote Code Execution Vulnerability | KB5127648, KB5126646, KB5127646 +9 |
| CVE-2026-108130 | Critical | 7.8 | Windows Virtualization-Based Security (VBS) Enclave | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | KB5127648, KB5127648, KB5127648 +2 |
| CVE-2026-88074 | Critical | 7.8 | Windows Virtualization-Based Security (VBS) Enclave | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | KB5126653, KB5127648, KB5127648 +2 |
| CVE-2026-108456 | Critical | 7.7 | Azure AI Foundry | Azure AI Foundry Elevation of Privilege Vulnerability | |
| CVE-2026-83947 | Critical | 7.7 | Azure Event Grid | Azure Event Grid Spoofing Vulnerability | |
| CVE-2026-108131 | Critical | 7.5 | Active Directory Federation Services (AD FS) | Active Directory Federation Services (AD FS) Spoofing Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-108448 | Critical | 7.5 | Microsoft Office Outlook | Microsoft Office Outlook Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-69789 | Critical | 7.5 | Reliable Multicast Transport Driver (RMCAST) | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | KB5122876, KB5122882, KB5122878 +9 |
| CVE-2026-88207 | Critical | 7.5 | Microsoft Office PowerPoint | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-96185 | Critical | 7.5 | Microsoft Exchange Online | Microsoft Exchange Online Remote Code Execution Vulnerability | |
| CVE-2026-96222 | Critical | 7.4 | Active Directory Federation Services (AD FS) | Active Directory Federation Services (AD FS) Spoofing Vulnerability | Release Notes, KB5126651, KB5126655 +21 |
| CVE-2026-108399 | Critical | 7.2 | Windows Hyper-V | Windows Hyper-V Elevation of Privilege Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-102211 | Critical | 7.0 | Windows Virtualization-Based Security (VBS) Enclave | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | KB5126868, KB5126651, KB5126657 +8 |
| CVE-2026-83917 | Critical | 7.0 | Windows ALPC | Windows ALPC Elevation of Privilege Vulnerability | KB5127648, KB5126646, KB5127646 +7 |
| CVE-2026-113341 | Critical | 6.5 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113341: Memory corruption | Release Notes |
| CVE-2026-108266 | Critical | — | Mariner (GitHub_M) | Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | |
| CVE-2026-108267 | Critical | — | Mariner (GitHub_M) | Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | |
| CVE-2026-110922 | Critical | — | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110922: Use after free in Prerender | Release Notes |
| CVE-2026-115557 | Critical | — | Mariner (PSF) | Distrust compromised intermediate certificates in ssl module | Release Notes |
| CVE-2026-62840 | Critical | — | Linux Kernel | Linux Kernel Elevation of Privilege Vulnerability | Release Notes |
| CVE-2026-83632 | Critical | — | Mariner (apache) | Apache Thrift: C++ THttpTransport grows its line buffer without bound | Release Notes |
| CVE-2026-100222 | Important | 9.8 | Network Policy Server (NPS) | Network Policy Server (NPS) Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-102210 | Important | 9.8 | Windows Text Shaping | Windows Text Shaping Remote Code Execution Vulnerability | KB5126651, KB5126657, KB5126657 +7 |
| CVE-2026-105010 | Important | 9.8 | Microsoft Windows Search Component | Microsoft Windows Search Component Elevation of Privilege Vulnerability | KB5126836, KB5126868, KB5126651 +9 |
| CVE-2026-69634 | Important | 9.8 | Windows iSCSI | Windows iSCSI Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-69639 | Important | 9.8 | Windows Libarchive | Windows libarchive Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +7 |
| CVE-2026-69705 | Important | 9.8 | Windows iSCSI | Windows iSCSI Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-69883 | Important | 9.8 | Windows iSCSI | Windows iSCSI Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-69886 | Important | 9.8 | Windows Imaging Component | Windows Imaging Component Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-70024 | Important | 9.8 | Windows Internet Information Services | Windows Internet Information Services Remote Code Execution Vulnerability | KB5126646, KB5127646, KB5126657 +10 |
| CVE-2026-70096 | Important | 9.8 | Windows Rich Text Edit Control | Windows Rich Text Edit Control Remote Code Execution Vulnerability | KB5127648, Release Notes, Release Notes +14 |
| CVE-2026-70157 | Important | 9.8 | Windows System Information Console | Windows System Information Console Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-83517 | Important | 9.8 | Microsoft Windows Media Foundation | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-83519 | Important | 9.8 | Windows Error Reporting | Windows Error Reporting Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-83578 | Important | 9.8 | Windows PowerShell | Microsoft PowerShell Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-83693 | Important | 9.8 | Windows Error Reporting | Windows Error Reporting Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-83748 | Important | 9.8 | Windows Error Reporting | Windows Error Reporting Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-83770 | Important | 9.8 | Windows Text Shaping | Windows Text Shaping Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-83780 | Important | 9.8 | Windows CCFFilter Driver | Windows CCFFilter Driver Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126646 +1 |
| CVE-2026-83782 | Important | 9.8 | Windows Shell | Windows Shell Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-83869 | Important | 9.8 | Role: DNS Server | Windows Domain Name Service Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-83910 | Important | 9.8 | RPC Runtime | RPC Runtime Library Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-83935 | Important | 9.8 | Microsoft XML | Microsoft XML Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-84015 | Important | 9.8 | Remote Access Point-to-Point Protocol (PPP) EAP-TLS | Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-85792 | Important | 9.8 | Windows Routing and Remote Access Service (RRAS) | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-85806 | Important | 9.8 | Network Policy Server (NPS) | Network Policy Server (NPS) Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-85809 | Important | 9.8 | Windows Routing and Remote Access Service (RRAS) | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | KB5127648, KB5126651, KB5126655 +10 |
| CVE-2026-85814 | Important | 9.8 | Microsoft Windows Media Foundation | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-85928 | Important | 9.8 | Windows Volume Manager Extension Driver | Windows Volume Manager Extension Driver Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126657 +10 |
| CVE-2026-88102 | Important | 9.8 | Windows Failover Cluster | Microsoft Failover Cluster Remote Code Execution Vulnerability | KB5126651, KB5126655, KB5126646 |
| CVE-2026-96096 | Important | 9.8 | Windows Media Player | Windows Media Player Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-96113 | Important | 9.8 | Role: DNS Server | Windows Domain Name Service Remote Code Execution Vulnerability | KB5126836, KB5126868, KB5126651 +3 |
| CVE-2026-96219 | Important | 9.8 | Windows Local Security Authority Subsystem Service (LSASS) | Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability | KB5127646, KB5126651, KB5126657 +7 |
| CVE-2026-96320 | Important | 9.8 | Windows DHCP Server | Windows DHCP Server Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-96864 | Important | 9.8 | Microsoft Failover Cluster Virtual Driver | Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-96909 | Important | 9.8 | Windows BitLocker | Windows BitLocker Remote Code Execution Vulnerability | KB5126655, KB5126653, KB5127648 +4 |
| CVE-2026-96924 | Important | 9.8 | Windows OLE | Windows OLE Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-97805 | Important | 9.8 | Windows Partition Management Driver | Windows Partition Management Driver Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-97815 | Important | 9.8 | Windows Error Reporting | Windows Error Reporting Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-97816 | Important | 9.8 | OpenSSH for Windows | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability | KB5126651, KB5126657, KB5126657 +7 |
| CVE-2026-102238 | Important | 9.6 | Visual Studio Code | Visual Studio Code Remote Code Execution Vulnerability | Release Notes |
| CVE-2026-102304 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102304: Use after free | Release Notes |
| CVE-2026-102306 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102306: Use after free | Release Notes |
| CVE-2026-102308 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102308: Use after free | Release Notes |
| CVE-2026-102309 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102309: Use after free | Release Notes |
| CVE-2026-102316 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102316: Use after free | Release Notes |
| CVE-2026-102322 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102322: Incorrect Authorization | Release Notes |
| CVE-2026-106211 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106211: Use after free | Release Notes |
| CVE-2026-106227 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106227: Use after free | Release Notes |
| CVE-2026-106239 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106239: Integer overflow | Release Notes |
| CVE-2026-106281 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106281: Use after free | Release Notes |
| CVE-2026-106329 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106329: Incorrect authorization | Release Notes |
| CVE-2026-110144 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110144: Incorrect authorization | Release Notes |
| CVE-2026-110159 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110159: Incorrect authorization | Release Notes |
| CVE-2026-113020 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113020: Improper input validation | Release Notes |
| CVE-2026-113222 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113222: Use after free | Release Notes |
| CVE-2026-113252 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113252: Improper input validation | Release Notes |
| CVE-2026-113336 | Important | 9.6 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113336: Memory corruption | Release Notes |
| CVE-2026-56153 | Important | 9.4 | Mariner (apache) | Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char | Release Notes |
| CVE-2026-88092 | Important | 9.4 | ASP.NET Core | ASP.NET Core Tampering Vulnerability | Release Notes, Release Notes, KB5130034 +3 |
| CVE-2026-70279 | Important | 9.3 | Microsoft Exchange Server | Microsoft Exchange Server Spoofing Vulnerability | KB5128896, KB5128897, KB5128898 +1 |
| CVE-2026-70188 | Important | 9.1 | ASP.NET Core | ASP.NET Core Security Feature Bypass Vulnerability | Release Notes, Release Notes, Release Notes +3 |
| CVE-2026-96252 | Important | 9.1 | Active Directory Federation Services (AD FS) | Active Directory Federation Services (AD FS) Spoofing Vulnerability | KB5126835, KB5126836, KB5126868 +3 |
| CVE-2026-105008 | Important | 9.0 | Windows Schannel | Windows Schannel Spoofing Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-85818 | Important | 9.0 | Windows Schannel | Windows Schannel Spoofing Vulnerability | KB5127648, KB5126655, KB5126646 +4 |
| CVE-2026-100212 | Important | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-100214 | Important | 8.8 | Dynamics Business Central | Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability | Release Notes, Release Notes |
| CVE-2026-102203 | Important | 8.8 | RPC Runtime | RPC Runtime Remote Code Execution Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-102217 | Important | 8.8 | WebDAV | WebDAV Elevation of Privilege Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-102226 | Important | 8.8 | Dynamics Business Central | Dynamics Business Central Elevation of Privilege Vulnerability | Release Notes |
| CVE-2026-102235 | Important | 8.8 | Visual Studio Code | Visual Studio Code Remote Code Execution Vulnerability | Release Notes |
| CVE-2026-102299 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102299: Type confusion | Release Notes |
| CVE-2026-102302 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102302: Buffer overflow | Release Notes |
| CVE-2026-102321 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102321: Type confusion | Release Notes |
| CVE-2026-102323 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102323: Type confusion | Release Notes |
| CVE-2026-102326 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102326: Type confusion | Release Notes |
| CVE-2026-102328 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-102328: Type confusion | Release Notes |
| CVE-2026-102849 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-102850 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-102858 | Important | 8.8 | Microsoft Office OneNote | Microsoft Office OneNote Remote Code Execution Vulnerability | Release Notes |
| CVE-2026-102860 | Important | 8.8 | Microsoft Office SharePoint | Microsoft Office SharePoint Elevation of Privilege Vulnerability | KB5002927 |
| CVE-2026-102861 | Important | 8.8 | Microsoft Office SharePoint | Microsoft Office SharePoint Elevation of Privilege Vulnerability | KB5002927 |
| CVE-2026-102862 | Important | 8.8 | Microsoft Office SharePoint | Microsoft Office SharePoint Elevation of Privilege Vulnerability | KB5002927 |
| CVE-2026-102863 | Important | 8.8 | Microsoft Office SharePoint | Microsoft Office SharePoint Elevation of Privilege Vulnerability | KB5002927 |
| CVE-2026-102869 | Important | 8.8 | .NET and Visual Studio | .NET and Visual Studio Elevation of Privilege Vulnerability | Release Notes, Release Notes, KB5126868 +15 |
| CVE-2026-102870 | Important | 8.8 | ASP.NET Core | ASP.NET Core Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +7 |
| CVE-2026-103572 | Important | 8.8 | Visual Studio Tools for Applications and SQL Server Management Studio | Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability | Release Notes, Release Notes |
| CVE-2026-103575 | Important | 8.8 | Remote Desktop Client | Remote Desktop Client Remote Code Execution Vulnerability | KB5127648, KB5127648, KB5127648 +10 |
| CVE-2026-105007 | Important | 8.8 | Windows NDIS | Windows NDIS Elevation of Privilege Vulnerability | KB5126835, KB5126836, KB5126868 +10 |
| CVE-2026-105591 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105593 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105595 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105596 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105597 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105598 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105716 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105717 | Important | 8.8 | Microsoft Office Access | Microsoft Office Access Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-105727 | Important | 8.8 | Dynamics Business Central | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability | Release Notes |
| CVE-2026-106190 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106190: Use after free | Release Notes |
| CVE-2026-106193 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106193: Use after free | Release Notes |
| CVE-2026-106200 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106200: Use after free | Release Notes |
| CVE-2026-106203 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106203: Incomplete cleanup | Release Notes |
| CVE-2026-106204 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106204: Use after free | Release Notes |
| CVE-2026-106235 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106235: Use after free | Release Notes |
| CVE-2026-106240 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106240: Type confusion | Release Notes |
| CVE-2026-106248 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106248: Use after free | Release Notes |
| CVE-2026-106255 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106255: Race condition | Release Notes |
| CVE-2026-106257 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106257: Use after free | Release Notes |
| CVE-2026-106268 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106268: Use after free | Release Notes |
| CVE-2026-106269 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106269: Use after free | Release Notes |
| CVE-2026-106278 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106278: Use after free | Release Notes |
| CVE-2026-106308 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106308: Incorrect reference resolution | Release Notes |
| CVE-2026-106318 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106318: Use after free | Release Notes |
| CVE-2026-106346 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106346: Improper state validation | Release Notes |
| CVE-2026-106349 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106349: Use after free | Release Notes |
| CVE-2026-106357 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106357: Use after free | Release Notes |
| CVE-2026-106383 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106383: Use after free | Release Notes |
| CVE-2026-106411 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106411: Use after free | Release Notes |
| CVE-2026-106421 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106421: Use after free | Release Notes |
| CVE-2026-106423 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-106423: Use after free | Release Notes |
| CVE-2026-107350 | Important | 8.8 | Mariner (PostgreSQL) | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer | Release Notes |
| CVE-2026-108426 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108427 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108428 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108429 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108430 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108431 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108432 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108437 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108441 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108442 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108443 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108444 | Important | 8.8 | Microsoft Office | Microsoft Office Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108445 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108446 | Important | 8.8 | Microsoft Office Excel | Microsoft Office Excel Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +2 |
| CVE-2026-108447 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108449 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-108450 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108451 | Important | 8.8 | Microsoft Office Word | Microsoft Office Word Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes |
| CVE-2026-108452 | Important | 8.8 | Microsoft Office SharePoint | Microsoft Office SharePoint Remote Code Execution Vulnerability | KB5002927 |
| CVE-2026-108458 | Important | 8.8 | Remote Desktop Client | Remote Desktop Client Remote Code Execution Vulnerability | KB5127648, KB5126657, KB5127648 +9 |
| CVE-2026-108463 | Important | 8.8 | Windows SmartScreen | Windows SmartScreen Security Feature Bypass Vulnerability | KB5127648, KB5127648, KB5127648 +1 |
| CVE-2026-110137 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110137: Use after free | Release Notes |
| CVE-2026-110139 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110139: Use after free | Release Notes |
| CVE-2026-110140 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110140: Type confusion | Release Notes |
| CVE-2026-110147 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110147: Use after free | Release Notes |
| CVE-2026-110153 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110153: Use after free | Release Notes |
| CVE-2026-110154 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110154: Use after free | Release Notes |
| CVE-2026-110155 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110155: Buffer overflow | Release Notes |
| CVE-2026-110157 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110157: Use after free | Release Notes |
| CVE-2026-110162 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110162: Use after free | Release Notes |
| CVE-2026-110163 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110163: Use after free | Release Notes |
| CVE-2026-110164 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110164: Use after free | Release Notes |
| CVE-2026-110166 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110166: Buffer overflow | Release Notes |
| CVE-2026-110167 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110167: Use after free | Release Notes |
| CVE-2026-110168 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110168: Use after free | Release Notes |
| CVE-2026-110169 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110169: Use after free | Release Notes |
| CVE-2026-110171 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110171: Use after free | Release Notes |
| CVE-2026-110172 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-110172: Use after free | Release Notes |
| CVE-2026-112993 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-112993: Use after free | Release Notes |
| CVE-2026-113000 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113000: Memory corruption | Release Notes |
| CVE-2026-113012 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113012: Improper input validation | Release Notes |
| CVE-2026-113019 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113019: Use after free | Release Notes |
| CVE-2026-113040 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113040: Improper input validation | Release Notes |
| CVE-2026-113044 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113044: Use after free | Release Notes |
| CVE-2026-113058 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113058: Use after free | Release Notes |
| CVE-2026-113092 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113092: Use after free | Release Notes |
| CVE-2026-113093 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113093: Memory corruption | Release Notes |
| CVE-2026-113095 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113095: Out of bounds read | Release Notes |
| CVE-2026-113097 | Important | 8.8 | Microsoft Edge (Chromium-based) (Chrome) | Chromium CVE-2026-113097: Use after free | Release Notes |
Showing 400 of 3238; narrow by component or search.
Revised by Microsoft 2026-10-28. "Exploited" and "disclosed" are Microsoft's own words from the guide's exploitability index; a CVE's page carries NVD's, CISA's and the public exploit indexes' besides.