Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,403 vulnerabilities · newest first
- CVE-2026-96113Critical 9.8Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-96096Critical 9.8Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-88178Critical 9.8Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-88156Critical 9.8Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-88102Critical 9.8Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-85928Critical 9.8Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-85818Critical 9.0Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.Published Oct 13, 2026
- CVE-2026-85814Critical 9.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-85809Critical 9.8Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machinePublished Oct 13, 2026
- CVE-2026-85806Critical 9.8Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-85792Critical 9.8Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machinePublished Oct 13, 2026
- CVE-2026-84015Critical 9.8Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83935Critical 9.8Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83910Critical 9.8Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83869Critical 9.8Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83862Critical 9.8Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83782Critical 9.8Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83780Critical 9.8Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83770Critical 9.8Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83748Critical 9.8Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83693Critical 9.8Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83578Critical 9.8Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83519Critical 9.8Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-83517Critical 9.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70300Critical 9.8Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70291Critical 9.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70279Critical 9.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.Published Oct 13, 2026
- CVE-2026-70242Critical 9.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70157Critical 9.8Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70153Critical 9.8Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70147Critical 9.8Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70096Critical 9.8Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-70024Critical 9.8Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-69886Critical 9.8Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-69883Critical 9.8Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-69705Critical 9.8Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-69639Critical 9.8Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-69634Critical 9.8Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-110130Critical 10.0Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for…Published Oct 13, 2026
- CVE-2026-110112Critical 9.2Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated.Published Oct 13, 2026
- CVE-2026-105016Critical 9.8Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-105010Critical 9.8Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.Published Oct 13, 2026
- CVE-2026-105008Critical 9.0No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.Published Oct 13, 2026
- CVE-2026-102210Critical 9.8Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-100222Critical 9.8Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-100219Critical 9.8Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-100202Critical 9.8Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.Published Oct 13, 2026
- CVE-2026-102238Critical 9.6Visual Studio Code Remote Code Execution VulnerabilityPublished Oct 13, 2026
- CVE-2026-88092Critical 9.4Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass VulnerabilityPublished Oct 13, 2026
- CVE-2026-70188Critical 9.1Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass VulnerabilityPublished Oct 13, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-96113 | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-96096 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-88178 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-88156 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-88102 | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-85928 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-85818 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | Critical 9.0 | |
| CVE-2026-85814 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-85809 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | Critical 9.8 | |
| CVE-2026-85806 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-85792 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | Critical 9.8 | |
| CVE-2026-84015 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83935 | Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83910 | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83869 | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83862 | Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83782 | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83780 | Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83770 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83748 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83693 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83578 | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83519 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-83517 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70300 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70291 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70279 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | Critical 9.3 | |
| CVE-2026-70242 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70157 | Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70153 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70147 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70096 | Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-70024 | Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-69886 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-69883 | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-69705 | Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-69639 | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-69634 | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-110130 | Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for… | Critical 10.0 | |
| CVE-2026-110112 | Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. | Critical 9.2 | |
| CVE-2026-105016 | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-105010 | Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | Critical 9.8 | |
| CVE-2026-105008 | No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | Critical 9.0 | |
| CVE-2026-102210 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-100222 | Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-100219 | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-100202 | Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | Critical 9.8 | |
| CVE-2026-102238 | Visual Studio Code Remote Code Execution Vulnerability | Critical 9.6 | |
| CVE-2026-88092 | Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability | Critical 9.4 | |
| CVE-2026-70188 | Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability | Critical 9.1 |
Showing 251–300 of 40,403. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.