BaselineWatch
58550 CVEs · 127 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,550 New, 24 h1,348 Changed, 24 h1,924 In KEV127 Public exploit1,585 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-62825 9.8 critical 1.0% microsoft, azure_key_vault Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. Sat 24 Oct
CVE-2026-85925 8.2 high 1.0% microsoft, azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network. 16 Oct
CVE-2026-85922 7.4 high 1.0% microsoft, azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. 16 Oct
CVE-2026-105941 8.1 high 0.00% no CPE yet The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model. 20 Oct
CVE-2026-88132 5.9 medium 0.00% no CPE yet Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network. 19 Oct
CVE-2026-68870 5.3 medium 0.00% no CPE yet The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace. Sat 24 Oct
CVE-2026-15642 3.3 low 0.00% devolutions, devolutions_server Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected. Sat 24 Oct

7 of 7

Download these 7 as CSV · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.