Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-83789 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-54990 | 9.8 critical | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-49172 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-42990 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70153 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70147 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70262 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-70275 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-70157 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-96864 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-85928 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-105723 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-69634 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-69639 | 9.8 critical | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-105010 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-9182 | 9.8 critical | 1.0% | esri, arcgis_server | Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes. | Sun 25 Oct |
| CVE-2026-13019 | 9.8 critical | 1.0% | esri, portal_for_arcgis | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability. | Sun 25 Oct |
| CVE-2026-53412 | 9.8 critical | 1.0% | zoom, workplace_desktop, workplace_virtual_desktop_infrastructure | Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access. | 24 Oct |
| CVE-2026-62873 | 9.8 critical | 1.0% | microsoft, windows_admin_center | Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2023-29542 | 9.8 critical | 1.0% | mozilla, firefox, firefox_esr, thunderbird | A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. | 23 Oct |
| CVE-2026-83888 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network. | 21 Oct |
| CVE-2026-102210 | 9.8 critical | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-100202 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-100219 | 9.8 critical | 1.0% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-100222 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-83770 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83519 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83517 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83782 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83780 | 9.8 critical | 1.0% | no CPE yet | Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83748 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83693 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83578 | 9.8 critical | 1.0% | no CPE yet | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69705 | 9.8 critical | 1.0% | no CPE yet | Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-70096 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83935 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-84015 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69883 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-85806 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85809 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 16 Oct |
| CVE-2026-96924 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85814 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-70024 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85792 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 16 Oct |
| CVE-2026-69886 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97816 | 9.8 critical | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97815 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97814 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97805 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96219 | 9.8 critical | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. | 16 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.