Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-69429 | 7.5 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Heap-based buffer overflow in Windows IKE Extension allows an authorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-65681 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2016 | Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-61363 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-62787 | 7.5 high | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Use after free in Windows DNS allows an authorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-59134 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-59132 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-54113 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-57108 | 7.5 high | 1.0% | microsoft, .net | Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-56170 | 7.5 high | 1.0% | microsoft, .net | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-58627 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-58531 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-56648 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50685 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Double free in Windows DHCP Server allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-50647 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50496 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-50505 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Message Queuing allows an authorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-50500 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Netlogon allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50470 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-50424 | 7.5 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Untrusted pointer dereference in Windows Domain Controller allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50411 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50463 | 7.5 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-50414 | 7.5 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50355 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50330 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-50368 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50328 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. | Wed 28 Oct |
| CVE-2026-50304 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-49788 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-49787 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-49181 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-45646 | 7.5 high | 1.0% | microsoft, aspnet.odata, aspnetcore.odata | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-40378 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-54119 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50696 | 7.5 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50695 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-54983 | 7.5 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2026-50506 | 7.5 high | 1.0% | microsoft, aspnet.odata, aspnetcore.odata | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2023-54219 | 7.5 high | 1.0% | no CPE yet | In the Linux kernel, the following vulnerability has been resolved: Revert "IB/isert: Fix incorrect release of isert connection" Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is causing problems on OPA when DEVICE_REMOVAL is happening. ------------[ cut here ]------------ WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359 ib_cq_pool_cleanup+0xac/0xb0 [ib_core] Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1 Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS SE5C610.86B.01.01.0014.121820151719 12/18/2015 RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core] Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83 c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206 RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640 RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18 R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38 FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0 Call Trace: <TASK> ? __warn+0x80/0x130 ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] ? report_bug+0x195/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] disable_device+0x9d/0x160 [ib_core] __ib_unregister_device+0x42/0xb0 [ib_core] ib_unregister_device+0x22/0x30 [ib_core] rvt_unregister_device+0x20/0x90 [rdmavt] hfi1_unregister_ib_device+0x16/0xf0 [hfi1] remove_one+0x55/0x1a0 [hfi1] pci_device_remove+0x36/0xa0 device_release_driver_internal+0x193/0x200 driver_detach+0x44/0x90 bus_remove_driver+0x69/0xf0 pci_unregister_driver+0x2a/0xb0 hfi1_mod_cleanup+0xc/0x3c [hfi1] __do_sys_delete_module.constprop.0+0x17a/0x2f0 ? exit_to_user_mode_prepare+0xc4/0xd0 ? syscall_trace_enter.constprop.0+0x126/0x1a0 do_syscall_64+0x5c/0x90 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? exc_page_fault+0x65/0x150 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7ff1e643f5ab Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8 RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8 R13: 00000000000 ---truncated--- | Wed 28 Oct |
| CVE-2025-60467 | 7.5 high | 1.0% | gpac | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. | Tue 27 Oct |
| CVE-2026-6746 | 7.5 high | 1.0% | mozilla, firefox, thunderbird | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-41135 | 7.5 high | 1.0% | free5gc, pcf | free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory growth by sending repeated HTTP requests to the OAM endpoint. The root cause is a `router.Use()` call inside an HTTP handler that registers a new CORS middleware on every incoming request, permanently growing the Gin router's handler chain. This leads to progressive memory exhaustion and eventual Denial of Service of the PCF, preventing all UEs from obtaining AM and SM policies and blocking 5G session establishment. Version 1.4.3 contains a patch. | Mon 26 Oct |
| CVE-2026-6732 | 7.5 high | 1.0% | xmlsoft, redhat, libxml2, hardened_images, jboss_core_services | A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable. | Mon 26 Oct |
| CVE-2026-49293 | 7.5 high | 1.0% | sunnyadn, js-toml | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accumulator by the radix once per input digit. Each iteration performs a `BigInt * BigInt` operation on an accumulator that grows linearly with the number of digits already consumed, so the whole loop is O(n²) in the literal length. The lexer regex places no upper bound on the literal length, so a single TOML document containing one ~500 kB hex literal pins one CPU core for ~40 seconds on a modern laptop (Apple M-series, Node v22). Memory amplification is bounded but CPU amplification is severe and grows quadratically: doubling the literal length quadruples the work. A caller that invokes `load()` on attacker-controlled TOML (configuration upload endpoints, CI/CD systems ingesting third-party `*.toml`, IDE plugins, build tools) is exposed to a single-request CPU exhaustion DoS. Version 1.1.1 fixes the issue. | Sun 25 Oct |
| CVE-2026-54399 | 7.5 high | 1.0% | apache, httpcomponents_core | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length | Sun 25 Oct |
| CVE-2026-54428 | 7.5 high | 1.0% | apache, httpcomponents_core | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied. | Sun 25 Oct |
| CVE-2026-55470 | 7.5 high | 1.0% | hapifhir, hl7_fhir_core | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10. | Sun 25 Oct |
| CVE-2026-57220 | 7.5 high | 1.0% | broadcom, rabbitmq_server | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6. | Sun 25 Oct |
| CVE-2026-57803 | 7.5 high | 1.0% | no CPE yet | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7. | 24 Oct |
| CVE-2026-48068 | 7.5 high | 1.0% | no CPE yet | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. | 24 Oct |
| CVE-2026-48069 | 7.5 high | 1.0% | no CPE yet | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. | 24 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.