Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-49451 | 7.5 high | 1.0% | no CPE yet | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing through public OpenAPI.NET reader APIs and has been confirmed across both JSON and YAML reader paths. This vulnerability is fixed in 2.7.5 and 3.5.4. | 25 Oct |
| CVE-2026-57975 | 7.5 high | 1.0% | microsoft, edge_chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-57984 | 7.5 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-57986 | 7.5 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-57992 | 7.5 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-58276 | 7.5 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-58293 | 7.5 high | 1.0% | microsoft, edge_chromium | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-58294 | 7.5 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 25 Oct |
| CVE-2026-54063 | 7.5 high | 1.0% | excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0. | 25 Oct |
| CVE-2026-59117 | 7.5 high | 1.0% | microsoft, terminal | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network. | 24 Oct |
| CVE-2026-65769 | 7.5 high | 1.0% | microsoft, teams | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. | 24 Oct |
| CVE-2026-62835 | 7.5 high | 1.0% | microsoft, azure_portal | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. | 24 Oct |
| CVE-2026-96185 | 7.5 high | 1.0% | no CPE yet | Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. | 24 Oct |
| CVE-2026-66315 | 7.5 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 23 Oct |
| CVE-2026-96960 | 7.5 high | 1.0% | microsoft, .net, .net_framework | Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. | 22 Oct |
| CVE-2026-96959 | 7.5 high | 1.0% | microsoft, .net, .net_framework | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | 22 Oct |
| CVE-2026-96958 | 7.5 high | 1.0% | microsoft, .net, .net_framework | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | 22 Oct |
| CVE-2026-83855 | 7.5 high | 1.0% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network. | 21 Oct |
| CVE-2026-83860 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network. | 21 Oct |
| CVE-2026-70095 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 21 Oct |
| CVE-2026-102192 | 7.5 high | 1.0% | microsoft, windows_server_2019, windows_server_2022, windows_server_2025 | Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | 20 Oct |
| CVE-2026-96246 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network. | 20 Oct |
| CVE-2026-69454 | 7.5 high | 1.0% | no CPE yet | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | 19 Oct |
| CVE-2026-70012 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-84017 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | 19 Oct |
| CVE-2026-69991 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69992 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69994 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69995 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69996 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69997 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69998 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-70004 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2025-59248 | 7.5 high | 1.0% | microsoft, exchange_server, exchange_server_subscription_edition | Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 18 Oct |
| CVE-2026-66800 | 7.5 high | 1.0% | microsoft, azure_data_factory | Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. | 18 Oct |
| CVE-2026-85808 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-97788 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2026-97789 | 7.5 high | 1.0% | microsoft, windows_server_2022, windows_server_2025 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-70031 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-70014 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85334 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2026-85797 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2026-70033 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-70079 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-70082 | 7.5 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-85322 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2026-70155 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-85324 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-96071 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96325 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. | 16 Oct |
1200 of 3810 · Next · Previous
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.