Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69573 US
Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-72940 US
Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-70019 US
Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-72949 US
Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-72947 US
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69827 US
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69989 US
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-83952 US
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-83942 US
Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-70065 US
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-81381 GitHub US
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-81380 GitHub US
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-81379 US
Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-81378 US
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
EPSS 0.01 CVE-2026-81377 US
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-81376 US
Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-81357 US
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-81356 US
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally.
EPSS 0.00 CVE-2026-81355 US
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-81349 US
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-80097 Microsoft US
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-80093 US
Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally.
EPSS 0.00 CVE-2026-80083 US
Heap-based buffer overflow in Windows Work Folders allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-80075 US
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-80077 US
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-80074 US
Use after free in Windows DNS allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-78523 US
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-65669 Microsoft US
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-73029 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-68786 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67643 Microsoft US
Out-of-bounds read in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67636 Microsoft US
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78518 Microsoft US
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67389 Microsoft US
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78509 Microsoft US
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78517 Microsoft US
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78504 Microsoft US
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
EPSS 0.01 CVE-2026-78513 Microsoft US
Out-of-bounds read in Windows CD-ROM Driver allows an unauthorized attacker to disclose information with a physical attack.
EPSS 0.00 CVE-2026-78508 US
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78510 Microsoft US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78505 Microsoft US
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-78515 Microsoft US
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-78502 Microsoft US
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78511 Microsoft US
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67384 Microsoft US
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67383 Microsoft US
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67379 Microsoft US
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-67376 Microsoft US
Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78463 US
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67378 Microsoft US
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-78461 US
Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-78439 Microsoft US
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-77909 US
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-77908 Microsoft US
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-77907 US
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-77904 US
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-77899 US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-77898 Microsoft US
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69282 Microsoft US
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69273 Microsoft US