Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-65681 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2016 | Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-61363 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-62787 | 7.5 high | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Use after free in Windows DNS allows an authorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-59134 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-59132 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-54113 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-62898 | 7.5 high | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-62901 | 7.5 high | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-57108 | 7.5 high | 1.0% | microsoft, .net | Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-56170 | 7.5 high | 1.0% | microsoft, .net | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50651 | 7.5 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50648 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50527 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50525 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50524 | 7.5 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-47302 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-83843 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-85353 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-70207 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70133 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-70006 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-96866 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-96861 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-69988 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70058 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70163 | 7.5 high | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-83795 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | Tue 27 Oct |
| CVE-2026-103577 | 7.5 high | 1.0% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | Tue 27 Oct |
| CVE-2026-69577 | 7.5 high | 1.0% | microsoft, windows_server_2019, windows_server_2022, windows_server_2025 | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | Tue 27 Oct |
| CVE-2026-69986 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Tue 27 Oct |
| CVE-2026-69987 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Tue 27 Oct |
| CVE-2026-26154 | 7.5 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. | Mon 26 Oct |
| CVE-2026-32071 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. | Mon 26 Oct |
| CVE-2026-23666 | 7.5 high | 1.0% | microsoft, .net_framework | Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network. | Mon 26 Oct |
| CVE-2026-32952 | 7.5 high | 1.0% | microsoft, go-ntlmssp | go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue. | Mon 26 Oct |
| CVE-2026-26129 | 7.5 high | 1.0% | microsoft, 365_copilot_chat | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-26164 | 7.5 high | 1.0% | microsoft, 365_copilot_chat | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-33111 | 7.5 high | 1.0% | microsoft, copilot_chat | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-40379 | 7.5 high | 1.0% | microsoft, entra_id | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-69976 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-69984 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-103558 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | Mon 26 Oct |
| CVE-2026-103569 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-47633 | 7.5 high | 1.0% | microsoft, cost_management | Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-54130 | 7.5 high | 1.0% | microsoft, 365_copilot | Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-70105 | 7.5 high | 1.0% | microsoft, microsoft_365, office, office_2021 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-32210 | 7.5 high | 1.0% | microsoft, dynamics_365 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. | 26 Oct |
| CVE-2026-42895 | 7.5 high | 1.0% | microsoft, 365_copilot | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. | 25 Oct |
| CVE-2026-50519 | 7.5 high | 1.0% | microsoft, github_copilot_chat | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 25 Oct |
| CVE-2026-49451 | 7.5 high | 1.0% | no CPE yet | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing through public OpenAPI.NET reader APIs and has been confirmed across both JSON and YAML reader paths. This vulnerability is fixed in 2.7.5 and 3.5.4. | 25 Oct |
1150 of 3810 · Next · Previous
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.