Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 6 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-116945 Microsoft SQL Server Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft sql server 2025 for x64-based systems cu10, Microsoft sql server 2022, Microsoft sql server 2017 and 10 more

    Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-118740 Aspire Security Feature Bypass Vulnerability

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Microsoft aspire dashboard, Microsoft aspire.dashboard.sdk.linux-x64

    Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.

  4. CISA KEV addition Published · updated

    CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability

    MediumCVSS 6.5 CISA KEV added 2026-11-10 · due 2026-11-24 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Microsoft office 2021, Microsoft office 2024, Microsoft 365 apps and 3 more

    Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-120779 Visual Studio Code Remote Code Execution Vulnerability

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: Microsoft Visual Studio Code

    Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-116928 Windows Search Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 11 version 26h2 for arm64-based systems, Microsoft windows 11 version 26h2 for x64-based systems, Microsoft windows 10 1809 and 23 more

    Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-119990 Azure OpenAI Elevation of Privilege Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft azure open-ai, Microsoft Azure Open AI

    Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-114162 Microsoft Graph Elevation of Privilege Vulnerability

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Microsoft azure privileged management, Microsoft Azure Privileged Identity Management (PIM)

    Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-114160 Azure Managed Grafana Elevation of Privilege Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft azure managed grafana

    Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-80095 Microsoft Office SharePoint Elevation of Privilege Vulnerability

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    Affects: Microsoft sharepoint server, Microsoft SharePoint Server Subscription Edition

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-85844 Windows Kerberos Elevation of Privilege Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 10 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2022 and 27 more

    Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-114146 ASP.NET Core Elevation of Privilege Vulnerability

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    Affects: microsoft.aspnetcore.http.connections, Microsoft net 8.0 installed on windows, Microsoft net 8.0 installed on linux and 30 more

    Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-112967 Windows Xbox Live Networking Service Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 10 1809, Microsoft windows 10 21h2, Microsoft windows 10 22h2 and 14 more

    Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-96157 Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 10 1607, Microsoft Windows Server 2016, Microsoft windows 10 1809 and 23 more

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-96067 Microsoft Color Management Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 10 1607, Microsoft Windows Server 2016, Microsoft windows 10 1809 and 23 more

    Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-88243 Windows DHCP Server Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022 and 4 more

    Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-88234 Windows iSCSI Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022 and 4 more

    Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-96078 Microsoft Color Management Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 10 1607, Microsoft Windows Server 2016, Microsoft windows 10 1809 and 23 more

    Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-95901 Microsoft DirectMusic Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Microsoft windows 10 1607, Microsoft Windows Server 2016, Microsoft windows 10 1809 and 23 more

    Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).