Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS high ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-80097exploit | 8.6 high | 1.0% | microsoft, microsoft authenticator for android | Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. | 6 h ago |
| CVE-2026-69451exploit | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-62958exploit | 7.9 high | — | libriscv | libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18. | 7 h ago |
| CVE-2026-81963exploit | 7.8 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | 6 h ago |
| CVE-2026-69328exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally. | 6 h ago |
| CVE-2025-38248exploit | 7.8 high | 0.00% | linux | In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding to ensure multicast packets are forwarded to these ports even if the ports are not member in the matching MDB entry. When per-VLAN multicast snooping is enabled, the per-port multicast context is disabled on each port and the port is removed from the global router port list: # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 1 $ bridge -d mdb show | grep router However, the port can be re-added to the global list even when per-VLAN multicast snooping is enabled: # ip link set dev dummy1 type bridge_slave mcast_router 0 # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 Since commit 4b30ae9adb04 ("net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions"), when per-VLAN multicast snooping is enabled, multicast disablement on a port will disable the per-{port, VLAN} multicast contexts and not the per-port one. As a result, a port will remain in the global router port list even after it is deleted. This will lead to a use-after-free [1] when the list is traversed (when adding a new port to the list, for example): # ip link del dev dummy1 # ip link add name dummy2 up master br1 type dummy # ip link set dev dummy2 type bridge_slave mcast_router 2 Similarly, stale entries can also be found in the per-VLAN router port list. When per-VLAN multicast snooping is disabled, the per-{port, VLAN} contexts are disabled on each port and the port is removed from the per-VLAN router port list: # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 # ip link add name dummy1 up master br1 type dummy # bridge vlan add vid 2 dev dummy1 # bridge vlan global set vid 2 dev br1 mcast_snooping 1 # bridge vlan set vid 2 dev dummy1 mcast_router 2 $ bridge vlan global show dev br1 vid 2 | grep router router ports: dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 0 $ bridge vlan global show dev br1 vid 2 | grep router However, the port can be re-added to the per-VLAN list even when per-VLAN multicast snooping is disabled: # bridge vlan set vid 2 dev dummy1 mcast_router 0 # bridge vlan set vid 2 dev dummy1 mcast_router 2 $ bridge vlan global show dev br1 vid 2 | grep router router ports: dummy1 When the VLAN is deleted from the port, the per-{port, VLAN} multicast context will not be disabled since multicast snooping is not enabled on the VLAN. As a result, the port will remain in the per-VLAN router port list even after it is no longer member in the VLAN. This will lead to a use-after-free [2] when the list is traversed (when adding a new port to the list, for example): # ip link add name dummy2 up master br1 type dummy # bridge vlan add vid 2 dev dummy2 # bridge vlan del vid 2 dev dummy1 # bridge vlan set vid 2 dev dummy2 mcast_router 2 Fix these issues by removing the port from the relevant (global or per-VLAN) router port list in br_multicast_port_ctx_deinit(). The function is invoked during port deletion with the per-port multicast context and during VLAN deletion with the per-{port, VLAN} multicast context. Note that deleting the multicast router timer is not enough as it only takes care of the temporary multicast router states (1 or 3) and not the permanent one (2). [1] BUG: KASAN: slab-out-of-bounds in br_multicast_add_router.part.0+0x3f1/0x560 Write of size 8 at addr ffff888004a67328 by task ip/384 [...] Call Trace: <TASK> dump_stack ---truncated--- | 16 h ago |
| CVE-2026-69694 | 7.0 high | 3.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally. | 6 h ago |
| CVE-2026-77484 | 8.8 high | 2.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-65772 | 8.8 high | 2.0% | microsoft, microsoft dynamics 365 (on-premises) version 9.1 | Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | 6 h ago |
| CVE-2013-2056 | 7.5 high | 2.0% | red hat, red hat network satellite server v 5.3, red hat network satellite server v 5.4, red hat network satellite server v 5.5 | A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication process and obtain sensitive channel content. This vulnerability leads to unauthorized information disclosure. | 11 h ago |
| CVE-2026-85893 | 8.8 high | 1.0% | microsoft, microsoft edge (chromium-based) | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-83992 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-69598 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-77906 | 8.8 high | 1.0% | microsoft, microsoft visual studio 2026 version 18.9 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-81952 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-81955 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-81385 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-81352 | 8.8 high | 1.0% | microsoft, web media extensions | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-80096 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-80081 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-80085 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-80080 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78525 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78526 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78524 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78521 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78519 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-77481 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78514 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78512 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78507 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-66819 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-78462 | 8.8 high | 1.0% | microsoft, visual studio code | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 6 h ago |
| CVE-2026-78456 | 8.8 high | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr) | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-78442 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-77901 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-77486 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-77487 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-77483 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-77480 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-73028 | 8.8 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-71328 | 8.8 high | 1.0% | microsoft, .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-73013 | 8.8 high | 1.0% | microsoft, microsoft office for android, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-73023 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-73006 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-73012 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network. | 6 h ago |
| CVE-2026-73018 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-69465 | 8.8 high | 1.0% | microsoft, microsoft sharepoint server subscription edition | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-72973 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
| CVE-2026-72972 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 6 h ago |
50 of 944 · Next
Download these 944 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.