Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-69836exploit ×2 | 10.0 critical | 2.0% | microsoft, entra_id | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. | 18 Oct |
| CVE-2025-59246 | 9.8 critical | 8.0% | microsoft, entra_id | Azure Entra ID Elevation of Privilege Vulnerability | 8 Oct |
| CVE-2025-55241 | 10.0 critical | 2.0% | microsoft, entra_id | Azure Entra ID Elevation of Privilege Vulnerability | 18 Oct |
| CVE-2026-35431 | 10.0 critical | 1.0% | microsoft, entra_id | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-83941 | 9.9 critical | 1.0% | microsoft, microsoft entra | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. | Sat 31 Oct |
| CVE-2026-59115 | 9.9 critical | 1.0% | microsoft, entra_provisioning_service | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-69851 | 9.9 critical | 1.0% | microsoft, entra_id | Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2025-59218 | 9.6 critical | 1.0% | microsoft, entra_id | Azure Entra ID Elevation of Privilege Vulnerability | 8 Oct |
| CVE-2026-54733 | 9.3 critical | 1.0% | no CPE yet | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1. | 24 Oct |
| CVE-2026-62916 | 9.1 critical | 1.0% | microsoft, microsoft entra | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | Sat 31 Oct |
| CVE-2026-110112 | 9.2 critical | 0.00% | no CPE yet | Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators. | 17 Oct |
11 of 11
Download these 11 as CSV · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.