CVE Number | CVE Name | Base Score | Reference |
|---|
CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | 10.0 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96207 ↗ (opens in new tab) |
CVE-2026-94510 | Microsoft Bookings Elevation of Privilege Vulnerability | 9.9 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-94510 ↗ (opens in new tab) |
CVE-2026-98370 | xfrm: fix compat ALLOCSPI request use-after-free | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98370 ↗ (opens in new tab) |
CVE-2026-98191 | wifi: wlcore: release runtime PM ref on regdomain config failure | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98191 ↗ (opens in new tab) |
CVE-2026-98192 | wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98192 ↗ (opens in new tab) |
CVE-2026-98351 | wifi: virt_wifi: free skb when disconnected | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98351 ↗ (opens in new tab) |
CVE-2026-98311 | wifi: virt_wifi: don't transfer operstate before register | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98311 ↗ (opens in new tab) |
CVE-2026-98188 | wifi: p54: validate curve data length in the calibration curve converters | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98188 ↗ (opens in new tab) |
CVE-2026-98187 | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98187 ↗ (opens in new tab) |
CVE-2026-98186 | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98186 ↗ (opens in new tab) |
CVE-2026-98331 | wifi: mac80211: unlist vifs when their netdev is unregistered | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98331 ↗ (opens in new tab) |
CVE-2026-98333 | wifi: mac80211: reset the LED state when ifup fails | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98333 ↗ (opens in new tab) |
CVE-2026-98332 | wifi: mac80211: only operate on TDLS peers in the TDLS code | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98332 ↗ (opens in new tab) |
CVE-2026-98327 | wifi: mac80211: mesh: reset the CSA state when leaving | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98327 ↗ (opens in new tab) |
CVE-2026-98326 | wifi: mac80211: mesh: release the channel if start fails | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98326 ↗ (opens in new tab) |
CVE-2026-98337 | wifi: mac80211: don't start a ROC while scanning | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98337 ↗ (opens in new tab) |
CVE-2026-98336 | wifi: mac80211: don't offload TC setup on AP_VLAN interfaces | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98336 ↗ (opens in new tab) |
CVE-2026-98329 | wifi: mac80211: don't allow injecting frames wider than the chanctx | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98329 ↗ (opens in new tab) |
CVE-2026-98328 | wifi: mac80211: add HE 6 GHz capability in the scan elems len | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98328 ↗ (opens in new tab) |
CVE-2026-98335 | wifi: mac80211: abort chanswitch when leaving a mesh | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98335 ↗ (opens in new tab) |
CVE-2026-98348 | wifi: libipw: reject too-short association responses | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98348 ↗ (opens in new tab) |
CVE-2026-98193 | wifi: libipw: reject TKIP frames without a full MIC | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98193 ↗ (opens in new tab) |
CVE-2026-98340 | wifi: cfg80211: only group hidden BSSes with beacon entries | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98340 ↗ (opens in new tab) |
CVE-2026-98338 | wifi: cfg80211: ibss: ref BSS entry for joined event | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98338 ↗ (opens in new tab) |
CVE-2026-98330 | wifi: cfg80211: get the wiphy out of a dying network namespace | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98330 ↗ (opens in new tab) |
CVE-2026-98341 | wifi: cfg80211: don't free driver-owned scan requests | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98341 ↗ (opens in new tab) |
CVE-2026-98339 | wifi: cfg80211: don't filter by BSS type when removing stale entries | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98339 ↗ (opens in new tab) |
CVE-2026-98345 | wifi: cfg80211: check IP header size in cfg80211_classify8021d() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98345 ↗ (opens in new tab) |
CVE-2026-98255 | tcp: exclude old ACKs from tcp fast path | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98255 ↗ (opens in new tab) |
CVE-2026-98254 | swiotlb: use the adjusted address for the highmem page lookup | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98254 ↗ (opens in new tab) |
CVE-2026-98172 | smb: client: fix smbd_connection leak on cifs_get_tcp_session() error | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98172 ↗ (opens in new tab) |
CVE-2026-98167 | smb: client: fix server->total_read for compound encrypted PDUs | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98167 ↗ (opens in new tab) |
CVE-2026-98174 | smb: client: fix rlist race and missing initialization | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98174 ↗ (opens in new tab) |
CVE-2026-98168 | smb: client: fix reparse buffer bounds in cifs_query_reparse_point() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98168 ↗ (opens in new tab) |
CVE-2026-98171 | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98171 ↗ (opens in new tab) |
CVE-2026-98170 | smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98170 ↗ (opens in new tab) |
CVE-2026-98214 | selinux: recheck intermediate backing files on mprotect() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98214 ↗ (opens in new tab) |
CVE-2026-98215 | selinux: preserve user SID across nested backing files | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98215 ↗ (opens in new tab) |
CVE-2026-98232 | scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98232 ↗ (opens in new tab) |
CVE-2026-98287 | pppoatm: ensure a writable skb header and linear data | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98287 ↗ (opens in new tab) |
CVE-2026-98282 | powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98282 ↗ (opens in new tab) |
CVE-2026-98251 | openvswitch: avoid reallocating confirmed conntrack labels | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98251 ↗ (opens in new tab) |
CVE-2026-98322 | netfilter: nft_nat: fully initialise new_addr in netmap setup | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98322 ↗ (opens in new tab) |
CVE-2026-98321 | netfilter: nf_nat: unregister and release hooks on error | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98321 ↗ (opens in new tab) |
CVE-2026-98320 | netfilter: flowtable: hold reference on ct until flow is released | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98320 ↗ (opens in new tab) |
CVE-2026-98238 | net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98238 ↗ (opens in new tab) |
CVE-2026-98288 | net: stmmac: fix TSO header length truncation | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98288 ↗ (opens in new tab) |
CVE-2026-98272 | net: mvpp2: prevent buffer overflow in page_pool allocation | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98272 ↗ (opens in new tab) |
CVE-2026-98275 | net: ethernet: cortina: Ack RX overrun interrupt correctly | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98275 ↗ (opens in new tab) |
CVE-2026-98301 | net: bridge: mst: move switchdev call outside rcu | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98301 ↗ (opens in new tab) |
CVE-2026-98304 | net: bcmgenet: restore the hardware filters on open | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98304 ↗ (opens in new tab) |
CVE-2026-98233 | net/packet: clear RX owner on VNET header error | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98233 ↗ (opens in new tab) |
CVE-2026-98317 | neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98317 ↗ (opens in new tab) |
CVE-2026-98207 | mmc: spi: reset bytes_xfered before retrying CRC failures | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98207 ↗ (opens in new tab) |
CVE-2026-98209 | mmc: sdhci-of-aspeed: Remove children before releasing SDC resources | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98209 ↗ (opens in new tab) |
CVE-2026-98211 | mmc: mmci: Fix use-after-free in busy-timeout work | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98211 ↗ (opens in new tab) |
CVE-2026-98212 | mmc: hsq: Fix use-after-free in retry work | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98212 ↗ (opens in new tab) |
CVE-2026-98303 | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98303 ↗ (opens in new tab) |
CVE-2026-98199 | hwmon: (pmbus/core) increase number of phases and add new mask | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98199 ↗ (opens in new tab) |
CVE-2026-98363 | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98363 ↗ (opens in new tab) |
CVE-2026-98368 | esp: downgrade zerocopy managed frags before mutating skb frags | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98368 ↗ (opens in new tab) |
CVE-2026-98319 | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98319 ↗ (opens in new tab) |
CVE-2026-98180 | drm/msm: RCU-free the scheduler-containing ring and VM objects | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98180 ↗ (opens in new tab) |
CVE-2026-98181 | drm/gud: fix out-of-bounds write in gud_plane_atomic_check() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98181 ↗ (opens in new tab) |
CVE-2026-98176 | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98176 ↗ (opens in new tab) |
CVE-2026-98177 | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98177 ↗ (opens in new tab) |
CVE-2026-98179 | drm/amdgpu: fix rmmio iounmap skipped on device removal | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98179 ↗ (opens in new tab) |
CVE-2026-98270 | drm/amdgpu: check ras and obj before dereference | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98270 ↗ (opens in new tab) |
CVE-2026-98298 | dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98298 ↗ (opens in new tab) |
CVE-2026-98362 | clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98362 ↗ (opens in new tab) |
CVE-2026-98279 | btrfs: handle lack of space when cleaning up verity items | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98279 ↗ (opens in new tab) |
CVE-2026-98269 | btrfs: abort transaction on failure to update inode for hole punching and reflinking | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98269 ↗ (opens in new tab) |
CVE-2026-98249 | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98249 ↗ (opens in new tab) |
CVE-2026-98289 | af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98289 ↗ (opens in new tab) |
CVE-2026-97814 | Windows Text Shaping Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97814 ↗ (opens in new tab) |
CVE-2026-100202 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100202 ↗ (opens in new tab) |
CVE-2026-96934 | Windows DHCP Server Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96934 ↗ (opens in new tab) |
CVE-2026-56857 | Root.Mkdir(All) can follow junctions out of the root on Windows in os | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56857 ↗ (opens in new tab) |
CVE-2026-21413 | Raw Image Extension Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-21413 ↗ (opens in new tab) |
CVE-2026-98253 | RDMA/ucma: Serialize join and leave on copy_to_user failure | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98253 ↗ (opens in new tab) |
CVE-2026-98323 | RDMA/siw: Bound fragmented header copies by the remaining length | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98323 ↗ (opens in new tab) |
CVE-2026-98365 | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98365 ↗ (opens in new tab) |
CVE-2026-98352 | RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98352 ↗ (opens in new tab) |
CVE-2026-98353 | RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98353 ↗ (opens in new tab) |
CVE-2026-98252 | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98252 ↗ (opens in new tab) |
CVE-2026-105016 | Microsoft QUIC Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-105016 ↗ (opens in new tab) |
CVE-2026-100219 | Microsoft QUIC Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100219 ↗ (opens in new tab) |
CVE-2026-70153 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70153 ↗ (opens in new tab) |
CVE-2026-70147 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70147 ↗ (opens in new tab) |
CVE-2026-88178 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88178 ↗ (opens in new tab) |
CVE-2026-97749 | Microsoft Office Outlook Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97749 ↗ (opens in new tab) |
CVE-2026-97016 | Microsoft Office Outlook Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97016 ↗ (opens in new tab) |
CVE-2026-88156 | Microsoft Office Outlook Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88156 ↗ (opens in new tab) |
CVE-2026-70291 | Microsoft Office Outlook Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70291 ↗ (opens in new tab) |
CVE-2026-70242 | Microsoft Office Outlook Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70242 ↗ (opens in new tab) |
CVE-2026-88131 | Microsoft Dataverse Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88131 ↗ (opens in new tab) |
CVE-2026-98283 | KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98283 ↗ (opens in new tab) |
CVE-2026-98221 | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98221 ↗ (opens in new tab) |
CVE-2026-98222 | KEYS: encrypted: fix integer overflow of datablob_len | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98222 ↗ (opens in new tab) |
CVE-2026-98203 | Input: soc_button_array - check btns_desc->package.count | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98203 ↗ (opens in new tab) |
CVE-2026-98206 | Input: cyttsp5 - clamp the HID report size before memcpy | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98206 ↗ (opens in new tab) |
CVE-2026-98217 | IB/mlx4: Fix use-after-free on pkey sysfs registration failure | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98217 ↗ (opens in new tab) |
CVE-2026-98295 | Bluetooth: coredump: Quiesce dump work on unregister | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98295 ↗ (opens in new tab) |
CVE-2026-98292 | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98292 ↗ (opens in new tab) |
CVE-2026-77900 | Azure App Service Remote Code Execution Vulnerability | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-77900 ↗ (opens in new tab) |
CVE-2026-59797 | Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-59797 ↗ (opens in new tab) |
CVE-2026-56154 | Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56154 ↗ (opens in new tab) |
CVE-2026-57941 | Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57941 ↗ (opens in new tab) |
CVE-2026-98263 | ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98263 ↗ (opens in new tab) |
CVE-2026-98308 | ALSA: hda: trace PCM open only after assigning a stream | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98308 ↗ (opens in new tab) |
CVE-2026-98316 | ALSA: bcd2000: Fix race between rawmidi and disconnect | 9.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98316 ↗ (opens in new tab) |
CVE-2026-69435 | Azure SRE Agent Elevation of Privilege Vulnerability | 9.6 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-69435 ↗ (opens in new tab) |
CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | 9.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-78663 ↗ (opens in new tab) |
CVE-2026-96914 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96914 ↗ (opens in new tab) |
CVE-2026-108471 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108471 ↗ (opens in new tab) |
CVE-2026-102225 | Windows Text Shaping Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102225 ↗ (opens in new tab) |
CVE-2026-96943 | Windows Raw Image Extension Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96943 ↗ (opens in new tab) |
CVE-2026-96202 | Windows Raw Image Extension Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96202 ↗ (opens in new tab) |
CVE-2026-100220 | Windows Media Video Decoder Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100220 ↗ (opens in new tab) |
CVE-2026-96913 | Windows Kernel Elevation of Privilege Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96913 ↗ (opens in new tab) |
CVE-2026-105733 | Windows Hyper-V Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-105733 ↗ (opens in new tab) |
CVE-2026-102214 | Windows Hyper-V Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102214 ↗ (opens in new tab) |
CVE-2026-88073 | Windows Graphics Kernel Elevation of Privilege Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88073 ↗ (opens in new tab) |
CVE-2026-83934 | Windows GDI+ Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83934 ↗ (opens in new tab) |
CVE-2026-70250 | Windows DHCP Client Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70250 ↗ (opens in new tab) |
CVE-2026-96952 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96952 ↗ (opens in new tab) |
CVE-2026-108467 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108467 ↗ (opens in new tab) |
CVE-2026-102857 | Microsoft Office Visio Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102857 ↗ (opens in new tab) |
CVE-2026-102856 | Microsoft Office Visio Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102856 ↗ (opens in new tab) |
CVE-2026-102855 | Microsoft Office Visio Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102855 ↗ (opens in new tab) |
CVE-2026-88144 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88144 ↗ (opens in new tab) |
CVE-2026-70215 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70215 ↗ (opens in new tab) |
CVE-2026-97780 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97780 ↗ (opens in new tab) |
CVE-2026-97778 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97778 ↗ (opens in new tab) |
CVE-2026-97765 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97765 ↗ (opens in new tab) |
CVE-2026-97759 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97759 ↗ (opens in new tab) |
CVE-2026-97755 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97755 ↗ (opens in new tab) |
CVE-2026-97745 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97745 ↗ (opens in new tab) |
CVE-2026-97739 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97739 ↗ (opens in new tab) |
CVE-2026-100211 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100211 ↗ (opens in new tab) |
CVE-2026-100210 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100210 ↗ (opens in new tab) |
CVE-2026-100209 | Microsoft Office Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100209 ↗ (opens in new tab) |
CVE-2026-105718 | Microsoft Excel Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-105718 ↗ (opens in new tab) |
CVE-2026-108400 | HEVC Video Extensions Remote Code Execution Vulnerability | 8.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108400 ↗ (opens in new tab) |
CVE-2026-83943 | Azure API Center Information Disclosure Vulnerability | 8.7 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83943 ↗ (opens in new tab) |
CVE-2026-70187 | Windows Remote Desktop Services Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70187 ↗ (opens in new tab) |
CVE-2026-108460 | Windows Message Queuing Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108460 ↗ (opens in new tab) |
CVE-2026-88174 | Windows Deployment Services Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88174 ↗ (opens in new tab) |
CVE-2026-88171 | Windows DHCP Server Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88171 ↗ (opens in new tab) |
CVE-2026-88120 | Windows DHCP Server Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88120 ↗ (opens in new tab) |
CVE-2026-88119 | Windows DHCP Server Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88119 ↗ (opens in new tab) |
CVE-2026-88117 | Windows DHCP Server Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88117 ↗ (opens in new tab) |
CVE-2026-70229 | Windows Active Directory Domain Services Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70229 ↗ (opens in new tab) |
CVE-2026-69802 | Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-69802 ↗ (opens in new tab) |
CVE-2026-108457 | Microsoft Windows PDF Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108457 ↗ (opens in new tab) |
CVE-2026-88185 | Microsoft Office Word Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88185 ↗ (opens in new tab) |
CVE-2026-70269 | Microsoft Office Word Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70269 ↗ (opens in new tab) |
CVE-2026-102866 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102866 ↗ (opens in new tab) |
CVE-2026-70571 | Microsoft Exchange Server Remote Code Execution Vulnerability | 8.1 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70571 ↗ (opens in new tab) |
CVE-2026-88074 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 7.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88074 ↗ (opens in new tab) |
CVE-2026-108130 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 7.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108130 ↗ (opens in new tab) |
CVE-2026-100215 | Microsoft Graphics Component Remote Code Execution Vulnerability | 7.8 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100215 ↗ (opens in new tab) |
CVE-2026-83947 | Azure Event Grid Spoofing Vulnerability | 7.7 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83947 ↗ (opens in new tab) |
CVE-2026-69789 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | 7.5 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-69789 ↗ (opens in new tab) |
CVE-2026-88207 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | 7.5 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88207 ↗ (opens in new tab) |
CVE-2026-108131 | Active Directory Federation Services (AD FS) Spoofing Vulnerability | 7.5 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108131 ↗ (opens in new tab) |
CVE-2026-96222 | Active Directory Federation Services (AD FS) Spoofing Vulnerability | 7.4 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96222 ↗ (opens in new tab) |
CVE-2026-108399 | Windows Hyper-V Elevation of Privilege Vulnerability | 7.2 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108399 ↗ (opens in new tab) |
CVE-2026-102211 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 7.0 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102211 ↗ (opens in new tab) |
CVE-2026-83917 | Windows ALPC Elevation of Privilege Vulnerability | 7.0 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83917 ↗ (opens in new tab) |
CVE-2026-62840 | Linux Kernel Elevation of Privilege Vulnerability | 7.0 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-62840 ↗ (opens in new tab) |
CVE-2026-108266 | Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | TBD | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108266 ↗ (opens in new tab) |
CVE-2026-108267 | Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | TBD | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108267 ↗ (opens in new tab) |
CVE-2026-83632 | Apache Thrift: C++ THttpTransport grows its line buffer without bound | TBD | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83632 ↗ (opens in new tab) |
