Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-69839 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-68784 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-62801 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | 16 h ago |
| CVE-2024-9676 | 6.5 medium | 1.0% | red hat, red hat enterprise linux 8, red hat enterprise linux 9, red hat enterprise linux 9.4 extended update support | A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host. | 20 h ago |
| CVE-2013-1840 | 6.5 medium | 1.0% | red hat, openstack folsom for rhel 6, red hat openstack platform 16.2, red hat openstack platform 17.1 | A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials. | 20 h ago |
| CVE-2011-1594 | 6.5 medium | 1.0% | red hat, red hat network satellite server v 5.4, red hat enterprise linux 6, red hat enterprise linux 7 | A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft. | 20 h ago |
| CVE-2026-69304 | 5.9 medium | 1.0% | microsoft, .net 10.0 runtime, .net 8.0 runtime, .net 9.0 runtime | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-69803 | 5.9 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-78523 | 5.9 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows DNS allows an unauthorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-72978 | 5.9 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-70124 | 5.9 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69930 | 5.9 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69929 | 5.9 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69679 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | 16 h ago |
| CVE-2026-69637 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | 16 h ago |
| CVE-2026-69569 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-69591 | 5.7 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69416 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Buffer over-read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | 16 h ago |
| CVE-2026-69405 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | 16 h ago |
| CVE-2026-69393 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69372 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Out-of-bounds read in Windows Network File System allows an authorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-69317 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-68874 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69723 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69572 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69552 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69507 | 5.7 medium | 1.0% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-69349 | 5.7 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-85875 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-83949 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-83951 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81395 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81394 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81400 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81393 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81392 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81958 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81401 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81391 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81399 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81390 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-81387 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-78506 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-68831 | 5.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. | 16 h ago |
| CVE-2026-78513 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | 16 h ago |
| CVE-2011-3344 | 5.4 medium | 1.0% | red hat, red hat network satellite server v 5.4, red hat enterprise linux 6, red hat enterprise linux 7 | A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session. | 20 h ago |
| CVE-2011-2927 | 5.4 medium | 1.0% | red hat, red hat network satellite server v 5.4, red hat enterprise linux 6, red hat enterprise linux 7 | A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or HTML into web pages viewed by other users. The flaw is triggered through vectors related to Search forms, enabling attackers to potentially steal sensitive information or perform actions on behalf of the victim. | 20 h ago |
| CVE-2026-70575 | 5.3 medium | 1.0% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network. | 16 h ago |
| CVE-2026-81380 | 5.3 medium | 1.0% | microsoft, visual studio code | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-72976 | 5.0 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally. | 16 h ago |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.