Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 3 days
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-96198 | 8.8 high | 1.0% | microsoft, microsoft edge (chromium-based) | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-85897 | 8.8 high | 1.0% | microsoft, microsoft edge (chromium-based) | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-85890 | 8.8 high | 1.0% | microsoft, microsoft edge (chromium-based) | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-107326 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | 9 h ago |
| CVE-2026-104324 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data. | 9 h ago |
| CVE-2026-101288 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code. | 9 h ago |
| CVE-2026-107239 | 8.8 high | 1.0% | veeam, management pack for microsoft system center | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service. | 9 h ago |
| CVE-2024-7557 | 8.8 high | 1.0% | red hat, rhoai-2.14-rhel-8, red hat openshift data science (rhods) | A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources. | 10 h ago |
| CVE-2026-74341 | 8.8 high | 1.0% | linux | In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content. Add a bounds check on the response length. | 14 h ago |
| CVE-2026-72382 | 8.8 high | 1.0% | linux | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t. A malicious client can reach this with: SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff) Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations. Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow. | 14 h ago |
| CVE-2026-31432 | 8.8 high | 1.0% | linux | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor. The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs. This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning. | 14 h ago |
| CVE-2025-21955 | 8.8 high | 1.0% | linux | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent connection release during oplock break notification ksmbd_work could be freed when after connection release. Increment r_count of ksmbd_conn to indicate that requests are not finished yet and to not release the connection. | 14 h ago |
| CVE-2026-92574 | 8.8 high | 1.0% | red hat, confidential compute attestation, red hat enterprise linux 8, red hat enterprise linux 9 | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available. | 21 h ago |
| CVE-2026-104328 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | 23 h ago |
| CVE-2026-110193 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server. | 23 h ago |
| CVE-2026-110309 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. | 23 h ago |
| CVE-2026-89009 | 8.8 high | 1.0% | wavlink technology, wn535m1, wn535m3 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise. | Thu 29 Oct |
| CVE-2026-110244 | 8.8 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | Thu 29 Oct |
| CVE-2026-70341 | 8.8 high | 1.0% | microsoft, edge, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-85936 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-47303 | 8.8 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-47300 | 8.8 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-62870 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-58626 | 8.8 high | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 | Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-58594 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-58277 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-57087 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-57094 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-56647 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-56194 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-55052 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50666 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-47295 | 8.8 high | 1.0% | microsoft, microsoft sql server 2016 service pack 3 (gdr), microsoft sql server 2016 service pack 3 azure connect feature pack, microsoft sql server 2017 (cu 31) | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50444 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50474 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-50398 | 8.8 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50370 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network. | Wed 28 Oct |
| CVE-2026-50360 | 8.8 high | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 | Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-49178 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-48564 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-58608 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-55002 | 8.8 high | 1.0% | microsoft, microsoft sql server 2016 service pack 3 (gdr), microsoft sql server 2016 service pack 3 azure connect feature pack, microsoft sql server 2017 (cu 31) | External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-54982 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. | Wed 28 Oct |
| CVE-2026-88121 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-88142 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-88157 | 8.8 high | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-88159 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-78674 | 8.8 high | 1.0% | no CPE yet | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account. | Wed 28 Oct |
| CVE-2023-0698 | 8.8 high | 1.0% | google, chrome | Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2023-3634 | 8.8 high | 1.0% | no CPE yet | In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability. | Wed 28 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.