Filtered by vendor Microsoft
Subscribe
Total
28847 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-87695 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-10-27 | N/A | 7.8 HIGH |
| Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-87696 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-10-27 | N/A | 7.5 HIGH |
| Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-87698 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-87699 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-105006 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 6.4 MEDIUM |
| Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack. | |||||
| CVE-2026-108458 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-27 | N/A | 8.8 HIGH |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-108464 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-27 | N/A | 7.0 HIGH |
| Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-108467 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-109453 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-27 | N/A | 7.0 HIGH |
| Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69577 | 1 Microsoft | 3 Windows Server 2019, Windows Server 2022, Windows Server 2025 | 2026-10-27 | N/A | 7.5 HIGH |
| Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-69789 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-27 | N/A | 7.5 HIGH |
| Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. | |||||
| CVE-2026-69802 | 1 Microsoft | 5 Windows Server 2012, Windows Server 2016, Windows Server 2019 and 2 more | 2026-10-27 | N/A | 8.1 HIGH |
| Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69986 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 7.5 HIGH |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69987 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 7.5 HIGH |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-26180 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-26 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-27913 | 1 Microsoft | 5 Windows Server 2012, Windows Server 2016, Windows Server 2019 and 2 more | 2026-10-26 | N/A | 7.7 HIGH |
| Improper input validation in Windows BitLocker allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-32077 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-26 | N/A | 7.8 HIGH |
| Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-27918 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-26 | N/A | 7.8 HIGH |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-4482 | 2 Microsoft, Rapid7 | 2 Windows, Insight Agent | 2026-10-26 | N/A | 5.5 MEDIUM |
| The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user. | |||||
| CVE-2026-32152 | 1 Microsoft | 7 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 4 more | 2026-10-26 | N/A | 7.8 HIGH |
| Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | |||||