Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS medium ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-80084 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80076 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80078 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78520 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-78522 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80073 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80079 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67645 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67624 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78503 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67369 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu8), microsoft sql server 2025 for x64-based systems (gdr) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78453 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78441 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69562 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-77911 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-72975 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-72977 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-72974 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-72938 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-72956 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69626 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69636 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint server subscription edition | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69409 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint server subscription edition | Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69395 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-72942 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-64918 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise | Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. | Sat 31 Oct |
| CVE-2026-69624 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network. | Sat 31 Oct |
| CVE-2026-69497 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-69374 | 6.5 medium | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 | Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-69297 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68898 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-68780 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68779 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68778 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68777 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68776 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67648 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67641 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-67393 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67390 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67386 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-66816 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network. | Sat 31 Oct |
| CVE-2026-62762 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-70019 | 6.5 medium | 1.0% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-81381 | 6.5 medium | 1.0% | microsoft, visual studio code | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-81377 | 6.5 medium | 1.0% | microsoft, visual studio code | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | Sat 31 Oct |
| CVE-2026-73029 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67389 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78515 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78502 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
1000 of 18967 · Next · Previous
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.