Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-88198 | 8.8 high | 1.0% | microsoft, sharepoint_server | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 14 Oct |
| CVE-2018-25438 | 8.7 high | 1.0% | no CPE yet | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21. | Wed 28 Oct |
| CVE-2026-13084 | 8.7 high | 1.0% | watchguard, fireware | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2 | Sun 25 Oct |
| CVE-2026-40361 | 8.4 high | 1.0% | microsoft, 365_apps, office, office_long_term_servicing_channel | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Mon 26 Oct |
| CVE-2025-54910 | 8.4 high | 1.0% | microsoft, 365_apps, office, office_long_term_servicing_channel | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2026-88185 | 8.1 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-70269 | 8.1 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-102866 | 8.1 high | 1.0% | microsoft, sharepoint_server | Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 14 Oct |
| CVE-2026-50665 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-55130 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55128 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55134 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55132 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55038 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55055 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55127 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55033 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55032 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2025-54896 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54898 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54899 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54900 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54902 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54903 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54904 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54907 | 7.8 high | 1.0% | microsoft, 365_apps, office, office_long_term_servicing_channel | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-54908 | 7.8 high | 1.0% | microsoft, 365_apps, office, office_long_term_servicing_channel | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59227 | 7.8 high | 1.0% | microsoft, 365_apps, 365_copilot, office | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59231 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59233 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59234 | 7.8 high | 1.0% | microsoft, 365_apps, 365_copilot, office | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-60727 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-62199 | 7.8 high | 1.0% | microsoft, 365_apps, 365_copilot, excel | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-62200 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-62201 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-62203 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2026-55125 | 7.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2016 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62553 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62556 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62560 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62561 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62563 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62564 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2026-70105 | 7.5 high | 1.0% | microsoft, microsoft_365, office, office_2021 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-88207 | 7.5 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-70281 | 7.5 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | 15 Oct |
| CVE-2026-105715 | 7.5 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-105599 | 7.5 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-105592 | 7.5 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-105714 | 7.5 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | 15 Oct |
Download these 582 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.