[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105713 | 13 Oct 2026 | CVSS 5.7 | Microsoft SharePoint Server Subscription EditionServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network. | Fix |
| CVE-2026-105714 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105715 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseInteger overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105716 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105717 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105718 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-105719 | 13 Oct 2026 | CVSS 6.5 | Microsoft SharePoint Server Subscription EditionImproper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-105591 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105592 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105593 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105595 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105596 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105597 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105598 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105599 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105008 | 13 Oct 2026 | CVSS 9.0 | Microsoft Windows 10 Version 1607No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-105009 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2012Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105010 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-105013 | 13 Oct 2026 | CVSS 7.4 | Microsoft SharePoint Server Subscription EditionDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-105016 | 13 Oct 2026 | CVSS 9.8 | Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code ExecutionHeap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-104937 | 13 Oct 2026 | CVSS 8.1 | ShopwareShopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling… | |
| CVE-2026-105003 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105004 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105005 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 11 version 26H1Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105006 | 13 Oct 2026 | CVSS 6.4 | Microsoft Windows 10 Version 1607Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-105007 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a… | |
| CVE-2026-104342 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-104343 | 13 Oct 2026 | CVSS 5.5 | Adobe FrameMaker 2026Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could… | |
| CVE-2026-104344 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-104584 | 13 Oct 2026 | CVSS 9.8 | VulnerabilityreNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the… | |
| CVE-2026-104816 | 13 Oct 2026 | CVSS 8.5 | misskey-dev misskeyMisskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured… | |
| CVE-2026-104817 | 13 Oct 2026 | CVSS 8.7 | misskey-dev misskeyMisskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and… | |
| CVE-2026-104875 | 13 Oct 2026 | CVSS 7.1 | enteEnte provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery… | |
| CVE-2026-103856 | 13 Oct 2026 | CVSS 5.5 | Adobe FrameMaker 2026Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage… | |
| CVE-2026-103857 | 13 Oct 2026 | CVSS 5.5 | Adobe FrameMaker 2026Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage… | |
| CVE-2026-103937 | 13 Oct 2026 | CVSS 8.7 | misskey-dev misskeyMisskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not… | |
| CVE-2026-103966 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-103967 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-104340 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-104341 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-103569 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-103572 | 13 Oct 2026 | CVSS 8.8 | Microsoft Visual Studio 2022 version 17.14Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an… | |
| CVE-2026-103575 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-103576 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform… | |
| CVE-2026-103577 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 11 version 23H2Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-103578 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 11 version 26H1Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-103849 | 13 Oct 2026 | CVSS 10.0 | Adobe CommerceAdobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary… | |
| CVE-2026-103555 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-103558 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-103560 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows Server 2012Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
| CVE-2026-103565 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-103567 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-103568 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized… | |
| CVE-2026-102865 | 13 Oct 2026 | CVSS 6.5 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-102866 | 13 Oct 2026 | CVSS 8.1 | Microsoft SharePoint Server Subscription EditionImproper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102867 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-102869 | 13 Oct 2026 | CVSS 8.8 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a… | |
| CVE-2026-102870 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code ExecutionImproper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-103553 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-103554 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-102857 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102858 | 13 Oct 2026 | CVSS 8.8 | Microsoft Office 365 for MacHeap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102859 | 13 Oct 2026 | CVSS 4.6 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-102860 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102861 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionMissing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102862 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102863 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a… | Fix |
| CVE-2026-102864 | 13 Oct 2026 | CVSS 4.6 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-102599 | 13 Oct 2026 | CVSS 7.5 | Socket.IO: Engine.IO Protocol Revision Mismatch DoSSocket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can… | Fix |
| CVE-2026-102849 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102850 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102851 | 13 Oct 2026 | CVSS 6.1 | Microsoft Visual Studio CodeIncorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-102856 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102225 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102226 | 13 Oct 2026 | CVSS 8.8 | Microsoft Dynamics NAV 2018Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate… | |
| CVE-2026-102227 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | |
| CVE-2026-102229 | 13 Oct 2026 | CVSS 6.8 | Microsoft Visual Studio CodeImproper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose… | |
| CVE-2026-102231 | 13 Oct 2026 | CVSS 7.7 | Microsoft Visual Studio CodeImproper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-102232 | 13 Oct 2026 | CVSS 7.0 | Microsoft Visual Studio CodeIncorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-102233 | 13 Oct 2026 | CVSS 7.8 | Microsoft Visual Studio CodeMissing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-102215 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102216 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges… | Fix |
| CVE-2026-102217 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102218 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-102220 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-102221 | 13 Oct 2026 | CVSS 4.4 | Microsoft Windows 10 Version 1607No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-102207 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to… | Fix |
| CVE-2026-102208 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102209 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 26H1Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102210 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-102211 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102214 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Windows Hyper-V allows an authorized attacker to execute code locally. | Fix |
| CVE-2026-102201 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102202 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102203 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-102204 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows Subsystem for Linux (WSL2)Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges… | |
| CVE-2026-102205 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102206 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack. | Fix |
| CVE-2026-102194 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102195 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
Page 76 of 168