Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-83517 | 9.8 critical | 1.0% | no CPE yet | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-83935 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-84015 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69883 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2025-59245 | 9.8 critical | 1.0% | microsoft, sharepoint_online | Microsoft SharePoint Online Elevation of Privilege Vulnerability | 18 Oct |
| CVE-2025-62207 | 9.8 critical | 1.0% | microsoft, azure_monitor | Azure Monitor Elevation of Privilege Vulnerability | 18 Oct |
| CVE-2025-64655 | 9.8 critical | 1.0% | microsoft, dynamics_omnichannel_sdk_storage_containers | Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2025-64656 | 9.8 critical | 1.0% | microsoft, azure_application_gateway | Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2025-64657 | 9.8 critical | 1.0% | microsoft, azure_application_gateway | Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-62834 | 9.8 critical | 1.0% | microsoft, azure_data_factory | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-108065 | 9.8 critical | 1.0% | no CPE yet | SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query. | 16 Oct |
| CVE-2026-85806 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85809 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 16 Oct |
| CVE-2026-96924 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85814 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-70024 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-85792 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 16 Oct |
| CVE-2026-69886 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97816 | 9.8 critical | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97815 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97814 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-97805 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96219 | 9.8 critical | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96096 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-83869 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-88102 | 9.8 critical | 1.0% | microsoft, windows_server_2019, windows_server_2022, windows_server_2025 | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96320 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96909 | 9.8 critical | 1.0% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96113 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-96934 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-88178 | 9.8 critical | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-88156 | 9.8 critical | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-70291 | 9.8 critical | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-88131 | 9.8 critical | 1.0% | microsoft, dataverse | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-97016 | 9.8 critical | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-97749 | 9.8 critical | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-57090 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 14 Oct |
| CVE-2026-70300 | 9.8 critical | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 14 Oct |
| CVE-2026-45495 | 9.8 critical | 1.0% | microsoft, edge_chromium | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 14 Oct |
| CVE-2025-59503 | 9.8 critical | 1.0% | microsoft, azure_compute_resource_provider | Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network. | 8 Oct |
| CVE-2026-50380 | 9.6 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | 14 h ago |
| CVE-2026-55008 | 9.6 critical | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 14 h ago |
| CVE-2026-48561 | 9.6 critical | 1.0% | microsoft, microsoft edge copilot for android, microsoft edge copilot for ios | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network. | 14 h ago |
| CVE-2026-87701 | 9.6 critical | 1.0% | microsoft, azure cosmos db | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-35428 | 9.6 critical | 1.0% | microsoft, azure_cloud_shell | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-48582 | 9.6 critical | 1.0% | microsoft, exchange_online | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. | Sun 25 Oct |
| CVE-2026-56161 | 9.6 critical | 1.0% | microsoft, azure_logic_apps | Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. | Sat 24 Oct |
| CVE-2026-57104 | 9.6 critical | 1.0% | microsoft, azure_storage_explorer | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network. | Sat 24 Oct |
| CVE-2026-62896 | 9.6 critical | 1.0% | microsoft, teams | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | Sat 24 Oct |
| CVE-2026-70332 | 9.6 critical | 1.0% | microsoft, sharepoint_online | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | Sat 24 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.