Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-65667 | 10.0 critical | 1.0% | microsoft, teams | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-56191 | 10.0 critical | 1.0% | microsoft, exchange_online | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. | 24 Oct |
| CVE-2026-56163 | 10.0 critical | 1.0% | microsoft, azure_kubernetes_service | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-57106 | 10.0 critical | 1.0% | microsoft, purview_data_governance | Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-66803 | 10.0 critical | 1.0% | microsoft, azure_cosmos_db | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. | 23 Oct |
| CVE-2025-49752 | 10.0 critical | 1.0% | microsoft, azure_bastion_developer | Azure Bastion Elevation of Privilege Vulnerability | 18 Oct |
| CVE-2026-65770 | 10.0 critical | 1.0% | microsoft, azure_managed_instance_for_apache_cassandra | Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. | 18 Oct |
| CVE-2026-65801 | 10.0 critical | 1.0% | microsoft, exchange_online | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-65816 | 10.0 critical | 1.0% | microsoft, azure_web_apps | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-69555 | 10.0 critical | 1.0% | microsoft, azure_arc | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-69502 | 10.0 critical | 1.0% | microsoft, azure_sql_database | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. | 15 Oct |
| CVE-2026-96207 | 10.0 critical | 1.0% | microsoft, partner_center | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. | 15 Oct |
| CVE-2026-83711 | 10.0 critical | 1.0% | microsoft, azure_active_directory_b2c | Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. | 14 Oct |
| CVE-2026-70352 | 10.0 critical | 1.0% | microsoft, azure_ai_language_authoring | Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. | 14 Oct |
| CVE-2026-57092 | 9.9 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. | 16 h ago |
| CVE-2026-69399 | 9.9 critical | 1.0% | microsoft, azure arc | Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network. | Sat 31 Oct |
| CVE-2026-85878 | 9.9 critical | 1.0% | microsoft, azure horizondb | Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. | Sat 31 Oct |
| CVE-2026-85885 | 9.9 critical | 1.0% | microsoft, microsoft 365 copilot | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network. | Sat 31 Oct |
| CVE-2026-83941 | 9.9 critical | 1.0% | microsoft, microsoft entra | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. | Sat 31 Oct |
| CVE-2026-21515 | 9.9 critical | 1.0% | microsoft, azure_iot_central | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-33109 | 9.9 critical | 1.0% | microsoft, azure_managed_instance_for_apache_cassandra | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-33821 | 9.9 critical | 1.0% | microsoft, dynamics_365_customer_insights | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-42823 | 9.9 critical | 1.0% | microsoft, azure_logic_apps | Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-42898 | 9.9 critical | 1.0% | microsoft, dynamics_365 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-47647 | 9.9 critical | 1.0% | microsoft, dynamics_365 | Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-50481 | 9.9 critical | 1.0% | microsoft, azure_active_directory | Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-59115 | 9.9 critical | 1.0% | microsoft, entra_provisioning_service | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-62830 | 9.9 critical | 1.0% | microsoft, azure_sre_agent | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-56160 | 9.9 critical | 1.0% | microsoft, azure_red_hat_openshift | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-94510 | 9.9 critical | 1.0% | no CPE yet | Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. | 19 Oct |
| CVE-2026-68782 | 9.9 critical | 1.0% | microsoft, azure_sql_database | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-68789 | 9.9 critical | 1.0% | microsoft, azure_sql_database | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-69851 | 9.9 critical | 1.0% | microsoft, entra_id | Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-56188 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-56159 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-50518 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-50447 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-54990 | 9.8 critical | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-49172 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-42990 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network. | 16 h ago |
| CVE-2026-69595 | 9.8 critical | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-78445 | 9.8 critical | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-73025 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network. | Sat 31 Oct |
| CVE-2026-73010 | 9.8 critical | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-73009 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-70296 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-69590 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | Sat 31 Oct |
| CVE-2026-69910 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-69769 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-69829 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
Download these 258 as CSV · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.