Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-72933 Microsoft US
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-47297 Microsoft US
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-64918 Microsoft US
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-58599 Microsoft US
Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69824 Microsoft US
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69911 Microsoft US
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69600 Microsoft US
Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69586 Microsoft US
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69511 Microsoft US
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69467 Microsoft US
Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69456 Microsoft US
Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.
EPSS 0.00 CVE-2026-69453 Microsoft US
Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69444 Microsoft US
Out-of-bounds read in Windows VOLSNAP.SYS allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69427 Microsoft US
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69438 Microsoft US
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69386 Microsoft US
Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69365 Microsoft US
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-69360 Microsoft US
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-69376 Microsoft US
Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69322 Microsoft US
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-69308 Microsoft US
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69313 Microsoft US
Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-69294 Microsoft US
Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69299 Microsoft US
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69305 Microsoft US
Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69277 Microsoft US
Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69269 Microsoft US
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-69272 Microsoft US
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-68891 Microsoft US
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-68889 Microsoft US
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-68888 Microsoft US
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-68885 Microsoft US
Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-68852 Microsoft US
Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-68850 Microsoft US
Use after free in Microsoft Office Word allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-68843 Microsoft US
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68780 Microsoft US
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68779 Microsoft US
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68778 Microsoft US
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68777 Microsoft US
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68776 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-68775 Microsoft US
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67648 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-67642 Microsoft US
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-67641 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67639 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67638 Microsoft US
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67393 Microsoft US
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67390 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-67388 Microsoft US
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-67386 Microsoft US
Use after free in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-67385 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-67381 Microsoft US
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-67380 Microsoft US
Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-66818 Microsoft US
Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-66816 Microsoft US
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-66814 Microsoft US
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-56198 Microsoft US
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
KEV ✓ EPSS 0.01 CVE-2026-85880 Microsoft US
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-80097 Microsoft US
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-65669 Microsoft US