High-severity CVEs (page 23)
Page 23 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-88150 | High | 8.8 | 2026-10-13 | Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-88149 | High | 7.0 | 2026-10-13 | Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-88147 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. |
CVE-2026-88146 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an… |
CVE-2026-88145 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-88144 | High | 8.8 | 2026-10-13 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-88142 | High | 8.8 | 2026-10-13 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-88141 | High | 7.0 | 2026-10-13 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-88139 | High | 7.0 | 2026-10-13 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-88136 | High | 8.8 | 2026-10-13 | Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. |
CVE-2026-88135 | High | 7.8 | 2026-10-13 | Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. |
CVE-2026-88134 | High | 7.8 | 2026-10-13 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-88133 | High | 7.8 | 2026-10-13 | Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-88128 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-88127 | High | 7.0 | 2026-10-13 | Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-88126 | High | 7.8 | 2026-10-13 | Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. |
CVE-2026-88124 | High | 7.0 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-88121 | High | 8.0 | 2026-10-13 | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-88120 | High | 8.1 | 2026-10-13 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88119 | High | 8.1 | 2026-10-13 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88118 | High | 7.8 | 2026-10-13 | Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-88117 | High | 8.1 | 2026-10-13 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88116 | High | 8.8 | 2026-10-13 | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88115 | High | 8.8 | 2026-10-13 | Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network. |
CVE-2026-88114 | High | 8.8 | 2026-10-13 | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88113 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-88112 | High | 8.8 | 2026-10-13 | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88110 | High | 7.0 | 2026-10-13 | Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-88109 | High | 7.8 | 2026-10-13 | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. |
CVE-2026-88107 | High | 7.0 | 2026-10-13 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-88106 | High | 7.0 | 2026-10-13 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-88105 | High | 7.8 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-88103 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-88101 | High | 7.8 | 2026-10-13 | Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. |
CVE-2026-88100 | High | 7.8 | 2026-10-13 | Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-88098 | High | 7.0 | 2026-10-13 | Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally. |
CVE-2026-88096 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate pri… |
CVE-2026-88094 | High | 8.1 | 2026-10-13 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to el… |
CVE-2026-88093 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-88091 | High | 7.8 | 2026-10-13 | Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
CVE-2026-88080 | High | 7.8 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-88079 | High | 7.0 | 2026-10-13 | Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-88076 | High | 7.0 | 2026-10-13 | Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-88075 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat… |
CVE-2026-88074 | High | 7.8 | 2026-10-13 | Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2026-88073 | High | 8.8 | 2026-10-13 | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-88072 | High | 7.8 | 2026-10-13 | Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-88071 | High | 7.8 | 2026-10-13 | Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-88070 | High | 7.8 | 2026-10-13 | Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2026-87716 | High | 7.5 | 2026-10-13 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network. |
CVE-2026-87715 | High | 7.0 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87713 | High | 7.5 | 2026-10-13 | Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-87712 | High | 7.8 | 2026-10-13 | Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally. |
CVE-2026-87711 | High | 7.8 | 2026-10-13 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87710 | High | 7.0 | 2026-10-13 | Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. |
CVE-2026-87708 | High | 7.0 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87707 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-87706 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-87705 | High | 7.4 | 2026-10-13 | Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent net… |
CVE-2026-87704 | High | 7.0 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87702 | High | 7.8 | 2026-10-13 | Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-87700 | High | 7.8 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87699 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. |
CVE-2026-87697 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-87696 | High | 7.5 | 2026-10-13 | Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-87695 | High | 7.8 | 2026-10-13 | Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-87694 | High | 7.8 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87693 | High | 7.0 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-87692 | High | 7.8 | 2026-10-13 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-87691 | High | 7.8 | 2026-10-13 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-85945 | High | 7.8 | 2026-10-13 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-85943 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally. |
CVE-2026-85941 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privi… |
CVE-2026-85936 | High | 8.8 | 2026-10-13 | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. |
CVE-2026-85934 | High | 7.0 | 2026-10-13 | Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-85933 | High | 7.8 | 2026-10-13 | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
CVE-2026-85931 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. |
CVE-2026-85930 | High | 7.0 | 2026-10-13 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. |
CVE-2026-85927 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
CVE-2026-85926 | High | 8.1 | 2026-10-13 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
CVE-2026-85925 | High | 8.2 | 2026-10-13 | Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network. |
CVE-2026-85922 | High | 7.4 | 2026-10-13 | Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-85920 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2026-85918 | High | 7.0 | 2026-10-13 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
CVE-2026-85915 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-85914 | High | 7.0 | 2026-10-13 | Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-85912 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to… |
CVE-2026-85911 | High | 7.8 | 2026-10-13 | Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-85908 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-85906 | High | 7.8 | 2026-10-13 | Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. |
CVE-2026-85905 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-85904 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-85903 | High | 8.8 | 2026-10-13 | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-85902 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. |
CVE-2026-85901 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-85900 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-85891 | High | 7.5 | 2026-10-13 | Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network. |
CVE-2026-85884 | High | 7.8 | 2026-10-13 | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-85881 | High | 8.0 | 2026-10-13 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. |
CVE-2026-85879 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |