Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS medium ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-67383 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu8), microsoft sql server 2025 for x64-based systems (gdr) | Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-77896 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Remote Desktop Client allows an unauthorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-69683 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint server subscription edition | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69739 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69719 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69734 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69375 | 6.5 medium | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. | Sat 31 Oct |
| CVE-2026-69361 | 6.5 medium | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. | Sat 31 Oct |
| CVE-2026-72939 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-63523 | 6.5 medium | 1.0% | microsoft, skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 | Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. | Sat 31 Oct |
| CVE-2026-69839 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-68784 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68781 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67633 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-67630 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67629 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-62801 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | Sat 31 Oct |
| CVE-2026-66308 | 6.5 medium | 1.0% | microsoft, skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 | Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-66306 | 6.5 medium | 1.0% | microsoft, skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 | Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-100155 | 6.5 medium | 1.0% | kstover, ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | Sat 31 Oct |
| CVE-2012-5625 | 6.5 medium | 1.0% | red hat, openstack folsom for rhel 6, red hat openstack platform 16.2, red hat openstack platform 17.1 | OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV). | Fri 30 Oct |
| CVE-2011-1594 | 6.5 medium | 1.0% | red hat, red hat network satellite server v 5.4, red hat enterprise linux 6, red hat enterprise linux 7 | A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft. | Fri 30 Oct |
| CVE-2026-62839 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | Fri 30 Oct |
| CVE-2026-58639 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | Fri 30 Oct |
| CVE-2026-65794 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-62814 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62782 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-62714 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62720 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-61921 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-61918 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-69550 | 6.5 medium | 1.0% | microsoft, windows app for mac | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-70328 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-70327 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-65813 | 6.5 medium | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | Fri 30 Oct |
| CVE-2026-65785 | 6.5 medium | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. | Fri 30 Oct |
| CVE-2026-62915 | 6.5 medium | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. | Fri 30 Oct |
| CVE-2026-62750 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network. | Fri 30 Oct |
| CVE-2026-62745 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62742 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62716 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62715 | 6.5 medium | 1.0% | microsoft, windows server 2012 r2, windows server 2012 r2 (server core installation), windows server 2016 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62718 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-61924 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-61345 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-59138 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-63512 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. | Fri 30 Oct |
| CVE-2026-62837 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-18894 | 6.5 medium | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code. | Thu 29 Oct |
| CVE-2026-104309 | 6.5 medium | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | Thu 29 Oct |
1050 of 18975 · Next · Previous
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.