Browse CVE records published in 2026 CVE Archive, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 71921 matching CVEs · Page 2 of 1439.
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability.
Published Oct 14, 2026 · Updated Oct 14, 2026
Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
Published Oct 13, 2026 · Updated Oct 14, 2026
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Published Oct 13, 2026 · Updated Oct 14, 2026
