Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 3 days
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-118696 | 8.0 high | 0.00% | jetbrains, intellij idea, pycharm, phpstorm | In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates | Sat 31 Oct |
| CVE-2026-91917 | 8.0 high | 0.00% | dell, openmanage enterprise | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution. | Sat 31 Oct |
| CVE-2026-119287 | 8.0 high | 0.00% | zuke-build, zuke | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0. | Fri 30 Oct |
| CVE-2026-104615 | 7.9 high | 0.00% | suse, rancher | A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token. | Fri 30 Oct |
| CVE-2026-119682 | 7.9 high | 0.00% | manageengine, sharepoint manager plus | An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506. | Fri 30 Oct |
| CVE-2024-9675 | 7.8 high | 0.00% | red hat, red hat enterprise linux 8, red hat enterprise linux 8.6 advanced mission critical update support, red hat enterprise linux 8.6 telecommunications update service | A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah. | 12 h ago |
| CVE-2026-95521 | 7.8 high | — | red hat, red hat enterprise linux 10, red hat enterprise linux 6, red hat enterprise linux 7 | A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. | 13 h ago |
| CVE-2026-70125 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office ltsc 2021, microsoft office ltsc 2024 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-83498 | 7.8 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-84000 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-83995 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83990 | 7.8 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83985 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83983 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83987 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83980 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83982 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83978 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83977 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83981 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83973 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83968 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83972 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83970 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83967 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83954 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-83971 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-72965 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-81948 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81950 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81949 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81953 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81959 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81951 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81388 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81957 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81960 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81956 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81397 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81396 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81954 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81947 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81386 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81398 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-81353 | 7.8 high | 0.00% | microsoft, heif image extension | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-78448 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-78447 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-73026 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-73007 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-73024 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
1100 of 2870 · Next · Previous
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.