Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS high ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-116748 | 8.7 high | 1.0% | no CPE yet | Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion. | 11 h ago |
| CVE-2026-79880 | 8.7 high | 1.0% | no CPE yet | A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | 18 h ago |
| CVE-2012-5562 | 8.6 high | 1.0% | red hat, red hat satellite proxy v 5.6, red hat satellite 6 | A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are exposed to unauthorized parties. | 20 h ago |
| CVE-2026-67379 | 8.5 high | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-105044 | 8.5 high | 1.0% | no CPE yet | Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection | 23 h ago |
| CVE-2026-107588 | 8.4 high | 1.0% | no CPE yet | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0 Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1 npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1 | 20 h ago |
| CVE-2026-79882 | 8.3 high | 1.0% | no CPE yet | There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. | 18 h ago |
| CVE-2026-81379 | 8.2 high | 1.0% | microsoft, visual studio code | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 15 h ago |
| CVE-2026-81378 | 8.2 high | 1.0% | microsoft, visual studio code | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 15 h ago |
| CVE-2026-81357 | 8.2 high | 1.0% | microsoft, visual studio code | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 15 h ago |
| CVE-2026-81356 | 8.2 high | 1.0% | microsoft, visual studio code | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 15 h ago |
| CVE-2026-83997 | 8.1 high | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69530 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-78450 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-78444 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-78449 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-72987 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69510 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-72936 | 8.1 high | 1.0% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-47297 | 8.1 high | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69858 | 8.1 high | 1.0% | microsoft, windows server 2022, windows server 2025, windows server 2025 (server core installation) | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69813 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69786 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69620 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69546 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69438 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69827 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69989 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-77505 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-72981 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in IP Helper allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69380 | 8.1 high | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-70563 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | 15 h ago |
| CVE-2026-70342 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69524 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69325 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-55007 | 8.1 high | 1.0% | microsoft, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15, microsoft exchange server subscription edition rtm | Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-14476 | 8.0 high | 1.0% | no CPE yet | A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass. | 14 h ago |
| CVE-2026-83948 | 8.0 high | 1.0% | microsoft, microsoft azure cli | Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network. | 15 h ago |
| CVE-2026-69876 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | 15 h ago |
| CVE-2026-69807 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69777 | 8.0 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | 15 h ago |
| CVE-2026-69847 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | 15 h ago |
| CVE-2026-69773 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69826 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69727 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69714 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69643 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69619 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows exFAT File System allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69625 | 8.0 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69503 | 8.0 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Stack-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges over a network. | 15 h ago |
Download these 987 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.