Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2015-6117 | 6.1 medium | 7.0% | microsoft, sharepoint_foundation, sharepoint_server | Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2016-0011. | 14 Oct |
| CVE-2016-0011 | 5.4 medium | 5.0% | microsoft, sharepoint_server, sharepoint_foundation | Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117. | 15 Oct |
| CVE-2026-27914 | 7.8 high | 2.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-84015 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-85809 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 16 Oct |
| CVE-2026-85792 | 9.8 critical | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 16 Oct |
| CVE-2026-65807 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | 7 h ago |
| CVE-2026-56647 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network. | 7 h ago |
| CVE-2026-50666 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network. | 8 h ago |
| CVE-2026-85339 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 10 h ago |
| CVE-2026-70158 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 10 h ago |
| CVE-2026-105007 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability. The security update addresses the vulnerability by changing how ndis.sys validates buffer length. | Tue 27 Oct |
| CVE-2026-62785 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. | Sat 24 Oct |
| CVE-2026-62795 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. | Sat 24 Oct |
| CVE-2026-102203 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-83642 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-62819 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 7 h ago |
| CVE-2026-50686 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network. | 8 h ago |
| CVE-2026-50502 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. | 8 h ago |
| CVE-2026-96911 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | Thu 22 Oct |
| CVE-2026-103558 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | Mon 26 Oct |
| CVE-2026-84017 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | 19 Oct |
| CVE-2026-85808 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | 16 Oct |
| CVE-2026-85322 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2026-96245 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2025-54116 | 7.3 high | 1.0% | microsoft, windows_10_1507, windows_10_1607, windows_10_1809 | Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. | 18 Oct |
| CVE-2026-68803 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-64919 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-64920 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-64914 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-64908 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-64912 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-62807 | 7.8 high | 0.00% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-62803 | 7.8 high | 0.00% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-62776 | 7.8 high | 0.00% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-62761 | 7.8 high | 0.00% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-62721 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-58541 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-68811 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 7 h ago |
| CVE-2026-57096 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-65671 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-62812 | 7.8 high | 0.00% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-62758 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-61932 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-55025 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 8 h ago |
| CVE-2026-55022 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. | 8 h ago |
| CVE-2026-55024 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 8 h ago |
| CVE-2026-50421 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-50405 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-50351 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally. | 8 h ago |
50 of 88 · Next
Download these 88 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.