Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-96864 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-85928 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-115915 | 9.8 critical | 1.0% | vllm | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0. | 8 h ago |
| CVE-2026-114139 | 9.1 critical | 1.0% | no CPE yet | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1. | 22 h ago |
| CVE-2026-70341 | 8.8 high | 1.0% | microsoft, edge, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | 2 h ago |
| CVE-2026-85936 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | 3 h ago |
| CVE-2026-88121 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | 4 h ago |
| CVE-2026-88142 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | 4 h ago |
| CVE-2026-88157 | 8.8 high | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | 4 h ago |
| CVE-2026-88159 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | 4 h ago |
| CVE-2026-77496 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 5 h ago |
| CVE-2026-85339 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 5 h ago |
| CVE-2026-70258 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-83526 | 8.8 high | 1.0% | no CPE yet | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition, and is only exploitable if the '[fvplayer_editor]' shortcode is present, or the "Enable profile videos" setting is enabled. | 6 h ago |
| CVE-2026-70149 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally. | 6 h ago |
| CVE-2026-70158 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 6 h ago |
| CVE-2026-70210 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-85931 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-88115 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-70068 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network. | 7 h ago |
| CVE-2026-70069 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-70089 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-86929 | 8.8 high | 1.0% | apple, macos | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution. | 8 h ago |
| CVE-2026-114126 | 8.7 high | 1.0% | no CPE yet | Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6. | 22 h ago |
| CVE-2026-112395 | 8.2 high | 1.0% | python, pillow | Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0. | 7 h ago |
| CVE-2026-96640 | 8.2 high | 1.0% | python, pillow | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0. | 21 h ago |
| CVE-2026-70229 | 8.1 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-88120 | 8.1 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-88117 | 8.1 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-88119 | 8.1 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-70062 | 8.1 high | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-88133 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. | 4 h ago |
| CVE-2026-85359 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. | 6 h ago |
| CVE-2026-70131 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally. | 6 h ago |
| CVE-2026-62898 | 7.5 high | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. | 2 h ago |
| CVE-2026-62901 | 7.5 high | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. | 3 h ago |
| CVE-2026-83843 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network. | 3 h ago |
| CVE-2026-17615 | 7.5 high | 1.0% | no CPE yet | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability. | 4 h ago |
| CVE-2026-114138 | 7.5 high | 1.0% | no CPE yet | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2. | 5 h ago |
| CVE-2026-85353 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network. | 5 h ago |
| CVE-2026-70207 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-70133 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. | 6 h ago |
| CVE-2026-70006 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-96866 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | 7 h ago |
| CVE-2026-96861 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | 7 h ago |
| CVE-2026-69988 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-70058 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2025-52290 | 7.5 high | 1.0% | no CPE yet | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file. | 9 h ago |
| CVE-2026-70163 | 7.5 high | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. | 10 h ago |
| CVE-2026-6893 | 7.5 high | 1.0% | no CPE yet | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior. | Tue 27 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 22:21. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.