Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-69857 | 8.5 high | 1.0% | microsoft, azure cosmos db | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network. | 7 h ago |
| CVE-2026-65818 | 8.5 high | 1.0% | microsoft, microsoft power platform | Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network. | 7 h ago |
| CVE-2026-50340 | 8.5 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network. | Wed 28 Oct |
| CVE-2026-69543 | 8.5 high | 1.0% | microsoft, azure_virtual_machines | Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-40361 | 8.4 high | 1.0% | microsoft, 365_apps, office, office_long_term_servicing_channel | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Mon 26 Oct |
| CVE-2025-54910 | 8.4 high | 1.0% | microsoft, 365_apps, office, office_long_term_servicing_channel | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2026-72970 | 8.3 high | 1.0% | microsoft, microsoft edge (chromium-based) | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Fri 30 Oct |
| CVE-2026-35438 | 8.3 high | 1.0% | microsoft, windows_admin_center | Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-50521 | 8.3 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-58284 | 8.3 high | 1.0% | microsoft, edge_chromium | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-58285 | 8.3 high | 1.0% | microsoft, edge_chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-58287 | 8.3 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-58288 | 8.3 high | 1.0% | microsoft, edge_chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-58295 | 8.3 high | 1.0% | microsoft, edge_chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | Sun 25 Oct |
| CVE-2026-58281 | 8.3 high | 1.0% | microsoft, edge_chromium | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-58596 | 8.3 high | 1.0% | microsoft, edge_chromium | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-81379 | 8.2 high | 1.0% | microsoft, visual studio code | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 7 h ago |
| CVE-2026-81378 | 8.2 high | 1.0% | microsoft, visual studio code | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 7 h ago |
| CVE-2026-81357 | 8.2 high | 1.0% | microsoft, visual studio code | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 7 h ago |
| CVE-2026-81356 | 8.2 high | 1.0% | microsoft, visual studio code | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 7 h ago |
| CVE-2026-50528 | 8.2 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. | Wed 28 Oct |
| CVE-2026-50429 | 8.2 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-34327 | 8.2 high | 1.0% | microsoft, partner_center | Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-58525 | 8.2 high | 1.0% | microsoft, edge_chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | Sun 25 Oct |
| CVE-2026-69306 | 8.2 high | 1.0% | microsoft, visual_studio_code | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 24 Oct |
| CVE-2026-85925 | 8.2 high | 1.0% | microsoft, azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys | Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network. | 16 Oct |
| CVE-2026-85899 | 8.1 high | 1.0% | microsoft, microsoft edge (chromium-based) | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network. | 5 h ago |
| CVE-2026-83997 | 8.1 high | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69530 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-78450 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-78444 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-78449 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-72987 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69510 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-72936 | 8.1 high | 1.0% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-47297 | 8.1 high | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69858 | 8.1 high | 1.0% | microsoft, windows server 2022, windows server 2025, windows server 2025 (server core installation) | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69813 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69786 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69620 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69546 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69438 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69827 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69989 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-77505 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-72981 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in IP Helper allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-69380 | 8.1 high | 1.0% | microsoft, microsoft exchange server 2016 cumulative update 23, microsoft exchange server 2019 cumulative update 14, microsoft exchange server 2019 cumulative update 15 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | 7 h ago |
| CVE-2026-70563 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | 7 h ago |
| CVE-2026-70342 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network. | 7 h ago |
| CVE-2026-69524 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 7 h ago |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.