Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-69313 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69314 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69305 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69274 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69272 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-68889 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69775 | 7.1 high | 1.0% | microsoft, windows 11 version 23h2, windows server 2025, windows server 2025 (server core installation) | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69757 | 7.1 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69338 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69337 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Double free in Windows Registry allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69366 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69336 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-69296 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-68893 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-68846 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-68835 | 7.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network. | 17 h ago |
| CVE-2026-50682 | 7.1 high | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 | Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network. | Wed 28 Oct |
| CVE-2024-50033 | 7.1 high | 1.0% | linux, linux_kernel | In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at least 20, which is not good enough. We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried. Add iph and th pointers to make the code more readable. [1] BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455 ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline] ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212 ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 | 15 Oct |
| CVE-2026-77914 | 7.1 high | 1.0% | no CPE yet | rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences to escape the intended export directory and access files outside it that are readable by the application process. | 14 Oct |
| CVE-2026-66723 | 7.0 high | 1.0% | no CPE yet | MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions being performed on the remote instance as if executed by the user whose API key was used to set up the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured.This issue has been fixed in version 2.19.0 | 23 Oct |
| CVE-2026-34478 | 6.9 medium | 1.0% | apache, log4j | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly: * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue. | Mon 26 Oct |
| CVE-2026-34480 | 6.9 medium | 1.0% | apache, log4j | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output. | Mon 26 Oct |
| CVE-2026-34479 | 6.9 medium | 1.0% | apache, log4j | The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge. | Mon 26 Oct |
| CVE-2026-62702 | 6.8 medium | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 | Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network. | Fri 30 Oct |
| CVE-2026-58528 | 6.8 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. | Wed 28 Oct |
| CVE-2026-50426 | 6.8 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. | Wed 28 Oct |
| CVE-2026-61920 | 6.6 medium | 1.0% | microsoft, windows server 2012 r2, windows server 2012 r2 (server core installation), windows server 2016 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-102133 | 6.6 medium | 1.0% | accellion, kiteworks | An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control. | 8 Oct |
| CVE-2026-78453 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network. | 17 h ago |
| CVE-2026-69395 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network. | 17 h ago |
| CVE-2026-72942 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network. | 17 h ago |
| CVE-2026-69624 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network. | 17 h ago |
| CVE-2026-69497 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-69374 | 6.5 medium | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 | Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-69297 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network. | 17 h ago |
| CVE-2026-68898 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-62762 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-70019 | 6.5 medium | 1.0% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network. | 17 h ago |
| CVE-2026-77896 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Remote Desktop Client allows an unauthorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-72939 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-69839 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network. | 17 h ago |
| CVE-2026-62801 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | 17 h ago |
| CVE-2026-65794 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-62814 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62782 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-62714 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-62720 | 6.5 medium | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | Fri 30 Oct |
| CVE-2026-61921 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-61918 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | Fri 30 Oct |
| CVE-2026-65785 | 6.5 medium | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. | Fri 30 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.