Browse All CVEs
39,805 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62772 |
high | 7.8 | 0.0033 | 2026-10-29 | Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) a | |
CVE-2026-62775 |
medium | 5.5 | 0.0035 | 2026-10-29 | Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allo | |
CVE-2026-62785 |
high | 8.8 | 0.0082 | 2026-10-29 | Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows | |
CVE-2026-62795 |
high | 8.8 | 0.0082 | 2026-10-29 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthori | |
CVE-2026-62799 |
high | 7.8 | 0.0033 | 2026-10-29 | Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate | |
CVE-2026-62869 |
high | 8.8 | 0.0044 | 2026-10-29 | Insufficient verification of data authenticity in Azure Entra ID allows an authorized atta | |
CVE-2026-62871 |
high | 7.8 | 0.0047 | 2026-10-29 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. | |
CVE-2026-62877 |
high | 7.8 | 0.0033 | 2026-10-29 | Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate pri | |
CVE-2026-62886 |
high | 7.8 | 0.0047 | 2026-10-29 | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileg | |
CVE-2026-62897 |
high | 7.0 | 0.0037 | 2026-10-29 | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execut | |
CVE-2026-62898 |
high | 7.5 | 0.0103 | 2026-10-29 | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information o | |
CVE-2026-62899 |
medium | 5.9 | 0.0075 | 2026-10-29 | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET a | |
CVE-2026-62900 |
medium | 5.9 | 0.0075 | 2026-10-29 | Improper removal of sensitive information before storage or transfer in .NET allows an una | |
CVE-2026-62901 |
high | 7.5 | 0.0123 | 2026-10-29 | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service | |
CVE-2026-62902 |
medium | 6.5 | 0.0087 | 2026-10-29 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized at | |
CVE-2026-62909 |
high | 7.8 | 0.0034 | 2026-10-29 | Uncaught exception in .NET allows an authorized attacker to elevate privileges locally. | |
CVE-2026-63522 |
high | 7.8 | 0.0030 | 2026-10-29 | Incorrect permission assignment for critical resource in Azure SQL Database allows an auth | |
CVE-2026-65660 |
high | 8.8 | 0.0819 | 2026-10-29 | KEV 2 PoC | Microsoft SharePoint contains a code injection vulnerability which could allow an authoriz |
CVE-2026-65673 |
high | 7.8 | 0.0032 | 2026-10-29 | Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to e | |
CVE-2026-65675 |
high | 7.1 | 0.0064 | 2026-10-29 | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized | |
CVE-2026-65767 |
high | 8.8 | 0.0061 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-65768 |
high | 8.8 | 0.0094 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsof | |
CVE-2026-65769 |
medium | 6.5 | 0.0092 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allow | |
CVE-2026-65806 |
medium | 6.5 | 0.0084 | 2026-10-29 | Missing authorization in Azure CycleCloud allows an authorized attacker to disclose inform | |
CVE-2026-65811 |
high | 8.8 | 0.0096 | 2026-10-29 | Improper input validation in Power BI allows an authorized attacker to execute code over a | |
CVE-2026-65815 |
high | 8.8 | 0.0169 | 2026-10-29 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an author | |
CVE-2026-66301 |
medium | 6.5 | 0.0100 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-p | |
CVE-2026-68807 |
high | 7.8 | 0.0047 | 2026-10-29 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to ex | |
CVE-2026-68813 |
medium | 5.5 | 0.0054 | 2026-10-29 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose i | |
CVE-2026-68820 |
high | 7.0 | 0.0857 | 2026-10-29 | KEV 4 PoC | Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerab |
CVE-2026-68821 |
high | 7.3 | 0.0032 | 2026-10-29 | Improper privilege management in Windows Package Manager allows an authorized attacker to | |
CVE-2026-69223 |
critical | 9.1 | 0.0078 | 2026-10-29 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue | |
CVE-2026-69278 |
high | 7.8 | 0.0032 | 2026-10-29 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a | |
CVE-2026-69306 |
high | 8.2 | 0.0054 | 2026-10-29 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacke | |
CVE-2026-69320 |
high | 8.8 | 0.0086 | 2026-10-29 | Improper neutralization of special elements used in an os command ('os command injection') | |
CVE-2026-70310 |
medium | 5.5 | 0.0043 | 2026-10-29 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose in | |
CVE-2026-70321 |
high | 8.8 | 0.0169 | 2026-10-29 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized atta | |
CVE-2026-70326 |
high | 8.8 | 0.0078 | 2026-10-29 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized att | |
CVE-2026-70335 |
high | 7.8 | 0.0046 | 2026-10-29 | Improper neutralization of special elements used in an os command ('os command injection') | |
CVE-2026-70336 |
high | 8.8 | 0.0082 | 2026-10-29 | Improper control of generation of code ('code injection') in Visual Studio Code allows an | |
CVE-2026-70340 |
high | 8.1 | 0.0080 | 2026-10-29 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privile | |
CVE-2026-70354 |
high | 7.8 | 0.0036 | 2026-10-29 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. | |
CVE-2026-72971 |
medium | 5.5 | 0.0036 | 2026-10-29 | Improper link resolution before file access ('link following') in Windows Container Isolat | |
CVE-2026-73085 |
medium | 5.3 | 0.0046 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuth | |
CVE-2026-73086 |
high | 7.4 | 0.0030 | 2026-10-29 | nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to vers | |
CVE-2026-73087 |
low | 2.3 | 0.0046 | 2026-10-29 | Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBl | |
CVE-2026-27302 |
critical | 10.0 | 0.0117 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-47705 |
critical | 9.6 | 0.0056 | 2026-10-29 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the | |
CVE-2026-47940 |
high | 7.8 | 0.0031 | 2026-10-29 | Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that coul | |
CVE-2026-48381 |
critical | 9.0 | 0.0078 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements |