Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-40419 | 7.8 high | 0.00% | microsoft, 365_apps, office, office_long_term_servicing_channel | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-40359 | 7.8 high | 0.00% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Mon 26 Oct |
| CVE-2026-40360 | 7.8 high | 0.00% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Mon 26 Oct |
| CVE-2026-42831 | 7.8 high | 0.00% | microsoft, 365_copilot, office, office_long_term_servicing_channel | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | Mon 26 Oct |
| CVE-2026-32197 | 7.8 high | 0.00% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Sun 25 Oct |
| CVE-2026-68800 | 7.8 high | 0.00% | microsoft, 365_apps, excel, microsoft_365 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 Oct |
| CVE-2026-68798 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 Oct |
| CVE-2026-108433 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | 20 Oct |
| CVE-2025-59223 | 7.8 high | 0.00% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59224 | 7.8 high | 0.00% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59225 | 7.8 high | 0.00% | microsoft, 365_apps, excel, office | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59226 | 7.8 high | 0.00% | microsoft, 365_apps, office_long_term_servicing_channel | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59236 | 7.8 high | 0.00% | microsoft, 365_apps, office, office_long_term_servicing_channel | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59238 | 7.8 high | 0.00% | microsoft, 365_apps, office, office_long_term_servicing_channel | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-59243 | 7.8 high | 0.00% | microsoft, 365_apps, office_long_term_servicing_channel | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-62205 | 7.8 high | 0.00% | microsoft, 365_apps, office_long_term_servicing_channel | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2025-62216 | 7.8 high | 0.00% | microsoft, 365_apps, office_long_term_servicing_channel | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2026-97001 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 15 Oct |
| CVE-2026-96997 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-96995 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-88210 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | 15 Oct |
| CVE-2026-70220 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 15 Oct |
| CVE-2026-96996 | 7.8 high | 0.00% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 15 Oct |
| CVE-2026-88109 | 7.8 high | 0.00% | microsoft, 365_apps, office_2021, office_2024 | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-85340 | 7.8 high | 0.00% | microsoft, 365_apps, office_2021, office_2024 | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-50387 | 7.8 high | 0.00% | microsoft, 365_copilot, microsoft_365, office_2021 | Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally. | 14 Oct |
| CVE-2026-63533 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2016 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2026-64906 | 7.8 high | 0.00% | microsoft, 365_apps, access, office_2019 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2025-62557 | 7.8 high | 0.00% | microsoft, 365_apps, 365_copilot, office | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2026-97009 | 7.8 high | 0.00% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2026-117553 | 7.7 high | 0.00% | no CPE yet | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates. | Tue 27 Oct |
| CVE-2026-65695 | 7.6 high | 0.00% | no CPE yet | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation. | 24 Oct |
| CVE-2025-71427 | 7.6 high | 0.00% | no CPE yet | Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files. | 14 Oct |
| CVE-2026-60593 | 7.5 high | 0.00% | oracle, peoplesoft_enterprise_fin_staffing_front_office | Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of Oracle PeopleSoft (component: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Staffing Front Office. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Staffing Front Office accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). | 24 Oct |
| CVE-2026-107569 | 7.5 high | 0.00% | no CPE yet | Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect. | 20 Oct |
| CVE-2026-108448 | 7.5 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69477 | 7.3 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally. | 5 h ago |
| CVE-2026-69417 | 7.3 high | 0.00% | microsoft, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 5 h ago |
| CVE-2026-69402 | 7.3 high | 0.00% | microsoft, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 5 h ago |
| CVE-2026-56193 | 7.1 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-32188 | 7.1 high | 0.00% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Mon 26 Oct |
| CVE-2026-108158 | 7.1 high | 0.00% | no CPE yet | plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/. | 14 Oct |
| CVE-2026-39904 | 7.1 high | 0.00% | no CPE yet | Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system. | 8 Oct |
| CVE-2026-120207 | 7.0 high | — | thelia, thelia page module | Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories. | 4 h ago |
| CVE-2026-81389 | 7.0 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 5 h ago |
| CVE-2026-69610 | 7.0 high | 0.00% | microsoft, microsoft office 365 for mac, microsoft office ltsc for mac 2021, microsoft office ltsc for mac 2024 | Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally. | 5 h ago |
| CVE-2026-97774 | 7.0 high | 0.00% | microsoft, 365_apps | Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-70276 | 7.0 high | 0.00% | microsoft, 365_apps, office_2021, office_2024 | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-1789 | 6.9 medium | 0.00% | no CPE yet | A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device via crafted requests, affecting certain production printers and office/small office multifunction printers. | Mon 26 Oct |
| CVE-2026-50678 | 6.6 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
Download these 720 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.