CVE-2026-69827

CVE-2026-69827 affects Windows DNS Server and is caused by a race condition due to improper synchronization of a shared resource during concurrent execution. An unauthorized attacker can exploit this flaw to achieve remote code execution over the network. The Microsoft-assigned CVSS 3.1 score is ...

CVE-2026-83952

CVE-2026-83952 is a heap-based buffer overflow in Windows Resilient File System (ReFS) that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , reflecting low attack complexity, no user interaction re...

CVE-2026-69989

This use-after-free vulnerability in Windows DNS Server allows an unauthorized, unprivileged attacker to execute code over a network. The CVSS 3.1 base score is 8.1 (HIGH) , reflecting a network vector with high attack complexity and no required privileges or user interaction, with high impact to...

CVE-2026-83942

CVE-2026-83942 is a Windows Kernel elevation of privilege vulnerability caused by a missing authorization check , allowing an attacker with low local privileges to gain full control of the system (high impact on confidentiality, integrity, and availability). The vulnerability carries a CVSS 3.1 b...

CVE-2026-70065

CVE-2026-70065 affects the Windows DHCP Server , where a missing release of memory after its effective lifetime allows an unauthorized, network-based attacker to cause a denial of service with no impact to confidentiality or integrity. The CVSS 3.1 score is 7.5 (HIGH) with low attack complexity a...

CVE-2026-81381

CVE-2026-81381 affects GitHub Copilot and Visual Studio Code , where insufficiently protected credentials can be disclosed over a network by an unauthorized attacker, resulting in high confidentiality impact with no integrity or availability impact. The vulnerability is rated CVSS 6.5 (MEDIUM) wi...

CVE-2026-81380

CVE-2026-81380 is a command injection flaw in GitHub Copilot and Visual Studio Code that can allow an unauthenticated remote attacker to disclose information over a network . The vulnerability is rated CVSS 3.1 5.3 (MEDIUM) with a high attack complexity, no required privileges, and required user ...

CVE-2026-81379

Visual Studio Code is vulnerable to a security feature bypass caused by not failing securely ("failing open"), allowing an unauthorized network attacker to bypass a security control with low complexity and no privileges, though user interaction is required . The CVSS 3.1 score is 8.2 (HIGH) with ...

CVE-2026-81377

Visual Studio Code is affected by a path traversal vulnerability that allows an unauthorized attacker to perform tampering over a network. The attack vector is network-based with low complexity and no required privileges, but user interaction is required . The impact is rated HIGH for integrity ,...

CVE-2026-81378

An interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network . The vulnerability is rated CVSS 3.1: 8.2 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N , indicating that exploitation requires user interaction , results in ...

CVE-2026-81376

CVE-2026-81376 affects Visual Studio Code and stems from an incomplete comparison with missing factors , allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability is rated CVSS 9.6 (CRITICAL) with a changed scope, requiring user interaction but no prior auth...

CVE-2026-81356

Visual Studio Code is affected by an HTTP request/response smuggling vulnerability caused by inconsistent interpretation of HTTP requests. An unauthorized attacker can exploit this over a network to bypass a security feature , requiring user interaction. The Microsoft CVSS 3.1 score is 8.2 (HIGH)...

CVE-2026-81357

CVE-2026-81357 is a server-side request forgery (SSRF) vulnerability in Visual Studio Code that allows an unauthorized attacker to bypass a security feature over a network . The vulnerability requires user interaction but no prior privileges, and has a CVSS 3.1 score of 8.2 (HIGH) with high confi...

CVE-2026-81349

Azure HDInsight is affected by an OS command injection vulnerability in its Ambari component, resulting from improper neutralization of special elements used in OS commands. An authorized attacker can leverage this flaw over the network to elevate privileges , potentially compromising confidentia...

CVE-2026-81355

A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. The vulnerability is rated CVSS 3.1 7.5 (HIGH) with the vector AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H , indicating a local attack vector with high complexity, high privi...

CVE-2026-80093

A use-after-free flaw in the Windows Cloud Files Mini Filter Driver allows an authorized local attacker to achieve privilege escalation . The vulnerability is rated CVSS 7.0 (HIGH) with a local attack vector, high complexity, and low privileges required, impacting confidentiality, integrity, and ...

CVE-2026-80097

CVE-2026-80097 is an improper authentication vulnerability in Microsoft Authenticator that allows an unauthorized local attacker to elevate privileges . The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating a local attack with low complexity , no prior ...

CVE-2026-80075

CVE-2026-80075 is a heap-based buffer overflow in Windows Work Folders that allows an authorized attacker to elevate privileges locally . The Microsoft-assigned CVSS 3.1 score is 7.8 (HIGH) , with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low complexity, low...

CVE-2026-80083

CVE-2026-80083 is an untrusted pointer dereference in Windows Hyper-V that allows an authorized local attacker to execute code, with changed scope (privilege escape). The CVSS 3.1 score is 8.8 (HIGH) (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high impact to confidentiality, integrity, and ...

CVE-2026-80074

CVE-2026-80074 is a heap-based buffer overflow in Microsoft Remote Desktop Client that allows an unauthorized attacker to achieve remote code execution over the network. The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning exploitation requires user inter...

CVE-2026-80077

CVE-2026-80077 is a heap-based buffer overflow in the Microsoft Remote Desktop Client that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS v3.1 score is 8.8 (HIGH) , with an attack vector of network, low complexity, no privileges required, and user intera...

CVE-2026-78523

A use-after-free vulnerability in Windows DNS Server allows an unauthenticated, remote attacker to cause a denial of service over the network. NVD scores it 7.5 (HIGH) with low attack complexity, while Microsoft's CNA rates it 5.9 (MEDIUM) with high attack complexity. CISA's SSVC assessment indic...

CVE-2026-73029

CVE-2026-73029 is a buffer over-read vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to disclose information over a network. The CVSS 3.1 base score is 6.5 (MEDIUM) with high confidentiality impact but no integrity or availability impact. CISA's ...

CVE-2026-65669

CVE-2026-65669 is an elevation of privilege vulnerability in Microsoft SQL Server caused by improper neutralization of special elements in output used by a downstream component (injection). An unauthorized attacker can exploit it over a network with low complexity and no prior privileges , though...

CVE-2026-68786

CVE-2026-68786 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges required) to achieve remote code execution over a network with no user interaction. The assigned CVSS 3.1 score is 8.8 (HIGH) with impacts of High across confidentiality, inte...

CVE-2026-67643

Microsoft SQL Server is affected by a heap-based buffer overflow that allows an authorized attacker (low privileges required) to achieve remote code execution over the network. The vulnerability is rated CVSS 8.8 (HIGH) with high impact on confidentiality, integrity, and availability, and low att...

CVE-2026-67636

CVE-2026-67636 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is classified with a CVSS 3.1 base score of 8.5 (HIGH) , reflecting a network-based attack requiring low privileges ,...

CVE-2026-67389

Microsoft SQL Server is affected by an out-of-bounds read vulnerability that allows an authorized attacker (low privileges required) to disclose information over a network . The CVSS v3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidential...

CVE-2026-78518

CVE-2026-78518 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (HIGH) , with a network attack vector, low complexity, no privileges required, but user interaction requi...

CVE-2026-78509

CVE-2026-78509 is a heap-based buffer overflow in Microsoft Office Outlook that allows an unauthorized, remote attacker to achieve code execution over a network with no user interaction. The CNA-assigned CVSS 3.1 score is 9.8 (Critical) , reflecting low attack complexity and full impact on confid...

CVE-2026-78517

A heap-based buffer overflow in Microsoft Office Word allows an unauthorized, remote attacker to execute code over a network. The CVSS 3.1 score is 8.8 (HIGH) , with a network attack vector, low complexity, no required privileges, but user interaction required. CISA's SSVC assessment rates exploi...

CVE-2026-78504

CVE-2026-78504 is a stack-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to achieve remote code execution over a network . The vulnerability is rated CVSS 3.1: 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning exploitation requires user inter...

CVE-2026-78513

CVE-2026-78513 is an out-of-bounds read in Microsoft Office PowerPoint that allows an unauthorized local attacker to disclose information . The vulnerability requires user interaction (e.g., opening a crafted file) but no prior privileges. CVSS 3.1 score is 5.5 (MEDIUM) with high confidentiality ...

CVE-2026-78508

CVE-2026-78508 is an out-of-bounds read in the Windows CD-ROM Driver that allows an unauthorized attacker with physical access to disclose information. The CVSS 3.1 score is 4.6 (MEDIUM) , reflecting the physical attack vector, low complexity, no privileges required, and a high confidentiality im...

CVE-2026-78510

CVE-2026-78510 is a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code over a network . The vulnerability is scored CVSS 9.8 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N, meaning it requires no user interaction or prior authentication. No p...

CVE-2026-78505

CVE-2026-78505 is a heap-based buffer overflow in Microsoft Office that allows an unauthorized attacker to execute code over a network. The vulnerability is rated CVSS 3.1 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , meaning exploitation requires user interaction but no prior...

CVE-2026-78502

An out-of-bounds read in Microsoft Office Word allows an unauthorized, remote attacker to disclose information over a network, provided the victim opens a crafted document (user interaction required). The CVSS 3.1 base score is 6.5 (MEDIUM) with high confidentiality impact but no integrity or ava...

CVE-2026-78515

CVE-2026-78515 is an out-of-bounds read in Microsoft Office Excel that allows an unauthorized, remote attacker to disclose information over a network. The attack requires user interaction (e.g., opening a crafted file) but no prior privileges. CVSS 3.1 scores it 6.5 (Medium) with high confidentia...

CVE-2026-67384

Microsoft SQL Server is affected by an integer overflow or wraparound vulnerability that allows an authorized attacker to execute code over a network, leading to a remote code execution scenario. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, and low privileges req...

CVE-2026-78511

CVE-2026-78511 is a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction (e.g., opening a crafted document), with no prior privileges needed and low attack complexity. ...

CVE-2026-67383

Microsoft SQL Server is affected by an information disclosure vulnerability caused by the generation of error messages that contain sensitive information. An authorized attacker (low privileges required) can exploit this over a network to disclose sensitive data, with high confidentiality impact ...

CVE-2026-67379

CVE-2026-67379 is a stack-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over the network. The CVSS 3.1 score is 8.5 (HIGH) with a scope change, reflecting high impact on confidentiality, integrity, and availabili...

CVE-2026-67376

CVE-2026-67376 is an integer overflow or wraparound flaw in Microsoft SQL Server that allows an unauthorized, remote attacker to trigger a denial of service over the network. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating low attack complexity, n...

CVE-2026-78463

Microsoft Remote Desktop Client is affected by a code injection vulnerability (improper control of generation of code) that allows an unauthorized attacker to execute code over a network . The CNA (Microsoft) rates this as CVSS 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning e...

CVE-2026-67378

CVE-2026-67378 affects Microsoft SQL Server and is caused by an untrusted pointer dereference . An authorized attacker with low privileges can execute code over the network. The CVSS 3.1 score is 8.5 (HIGH) with a scope change, reflecting high impact on confidentiality, integrity, and availabilit...

CVE-2026-78461

Visual Studio Code is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to bypass a security feature over a network. The flaw requires user interaction but no prior authentication. Per the CNA (Microsoft),...

CVE-2026-78439

CVE-2026-78439 is a stack-based buffer overflow in the Microsoft Office Graphics Component that allows an unauthorized attacker to execute code over a network, rated CVSS 3.1: 8.8 (High) . The attack vector is network-based with low complexity and no privileges required , though user interaction ...

CVE-2026-77909

CVE-2026-77909 affects Azure CycleCloud , where insufficiently protected credentials allow an authorized attacker to disclose information over a network . The vulnerability is rated CVSS 3.1 7.7 (HIGH) with a scope change and high confidentiality impact (vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:...

CVE-2026-77908

CVE-2026-77908 is a code injection vulnerability in Microsoft Dynamics 365 On-Premises that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The flaw stems from improper control of code generation, and the CVSS 3.1 score is 8.8 (HIGH) with impacts ra...

CVE-2026-77907

A heap-based buffer overflow in Visual Studio allows an unauthorized attacker to achieve remote code execution over a network. The CVSS v3.1 score is 8.8 (High) , with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning user interaction is required but no prior privileges are needed. CISA's ...