High-severity CVEs (page 27)
Page 27 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-83566 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2026-83564 | High | 7.0 | 2026-10-13 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-83523 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network. |
CVE-2026-83522 | High | 8.1 | 2026-10-13 | Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-83520 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-83518 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally. |
CVE-2026-83516 | High | 7.5 | 2026-10-13 | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
CVE-2026-83514 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-83513 | High | 7.8 | 2026-10-13 | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-83511 | High | 7.4 | 2026-10-13 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-83510 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
CVE-2026-83509 | High | 7.0 | 2026-10-13 | Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
CVE-2026-83508 | High | 7.8 | 2026-10-13 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-83506 | High | 7.8 | 2026-10-13 | Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. |
CVE-2026-83505 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
CVE-2026-83499 | High | 7.8 | 2026-10-13 | Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-81971 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges… |
CVE-2026-81969 | High | 7.8 | 2026-10-13 | Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-78459 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-77910 | High | 8.8 | 2026-10-13 | Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-77902 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-77496 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
CVE-2026-73027 | High | 7.8 | 2026-10-13 | External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
CVE-2026-72969 | High | 7.0 | 2026-10-13 | Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72968 | High | 7.0 | 2026-10-13 | Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72955 | High | 7.0 | 2026-10-13 | Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally. |
CVE-2026-72934 | High | 7.0 | 2026-10-13 | Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-70580 | High | 8.8 | 2026-10-13 | Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. |
CVE-2026-70571 | High | 8.1 | 2026-10-13 | Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-70566 | High | 7.8 | 2026-10-13 | Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. |
CVE-2026-70343 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network. |
CVE-2026-70303 | High | 7.8 | 2026-10-13 | Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-70302 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-70301 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-70299 | High | 8.8 | 2026-10-13 | Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-70297 | High | 8.8 | 2026-10-13 | Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network. |
CVE-2026-70287 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-70286 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-70285 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70282 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-70281 | High | 7.5 | 2026-10-13 | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70278 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. |
CVE-2026-70276 | High | 7.0 | 2026-10-13 | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. |
CVE-2026-70275 | High | 8.8 | 2026-10-13 | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network. |
CVE-2026-70274 | High | 7.8 | 2026-10-13 | Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-70273 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70272 | High | 7.0 | 2026-10-13 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70271 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70269 | High | 8.1 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-70268 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-70267 | High | 7.2 | 2026-10-13 | Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-70266 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70262 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70258 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
CVE-2026-70257 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-70256 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-70255 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-70254 | High | 8.8 | 2026-10-13 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-70253 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70252 | High | 7.0 | 2026-10-13 | Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-70251 | High | 7.5 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70250 | High | 8.8 | 2026-10-13 | Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-70249 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70247 | High | 7.8 | 2026-10-13 | Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally. |
CVE-2026-70246 | High | 8.8 | 2026-10-13 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70245 | High | 7.8 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-70243 | High | 7.0 | 2026-10-13 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-70241 | High | 7.0 | 2026-10-13 | Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
CVE-2026-70238 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-70237 | High | 7.0 | 2026-10-13 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-70236 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70233 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-70230 | High | 7.0 | 2026-10-13 | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-70229 | High | 8.1 | 2026-10-13 | Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. |
CVE-2026-70228 | High | 7.8 | 2026-10-13 | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-70225 | High | 7.8 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-70223 | High | 7.0 | 2026-10-13 | Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-70222 | High | 7.8 | 2026-10-13 | Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-70220 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-70218 | High | 7.8 | 2026-10-13 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-70215 | High | 8.8 | 2026-10-13 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-70213 | High | 8.0 | 2026-10-13 | Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. |
CVE-2026-70212 | High | 7.0 | 2026-10-13 | Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-70210 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70209 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-70207 | High | 7.5 | 2026-10-13 | Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. |
CVE-2026-70205 | High | 7.0 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-70202 | High | 7.5 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70198 | High | 7.0 | 2026-10-13 | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2026-70197 | High | 8.1 | 2026-10-13 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70190 | High | 7.3 | 2026-10-13 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-70187 | High | 8.1 | 2026-10-13 | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
CVE-2026-70186 | High | 7.5 | 2026-10-13 | Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-70185 | High | 8.8 | 2026-10-13 | Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. |
CVE-2026-70184 | High | 7.8 | 2026-10-13 | Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally. |
CVE-2026-70183 | High | 7.5 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges… |
CVE-2026-70181 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-70179 | High | 7.5 | 2026-10-13 | Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70177 | High | 7.8 | 2026-10-13 | Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-70176 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |