High-severity CVEs (page 30)
Page 30 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-108463 | High | 8.8 | 2026-10-13 | Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-108461 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-108460 | High | 8.1 | 2026-10-13 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
CVE-2026-108458 | High | 8.8 | 2026-10-13 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-108457 | High | 8.1 | 2026-10-13 | Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. |
CVE-2026-108400 | High | 8.8 | 2026-10-13 | Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
CVE-2026-108399 | High | 7.2 | 2026-10-13 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-108398 | High | 8.8 | 2026-10-13 | Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. |
CVE-2026-108396 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-108136 | High | 7.8 | 2026-10-13 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-108135 | High | 7.0 | 2026-10-13 | Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. |
CVE-2026-108134 | High | 7.0 | 2026-10-13 | Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
CVE-2026-108133 | High | 7.8 | 2026-10-13 | Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-108132 | High | 7.0 | 2026-10-13 | Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
CVE-2026-108131 | High | 7.5 | 2026-10-13 | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-108130 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2026-106625 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploita… |
CVE-2026-105733 | High | 8.8 | 2026-10-13 | Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-105732 | High | 7.3 | 2026-10-13 | Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. |
CVE-2026-105729 | High | 7.1 | 2026-10-13 | Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. |
CVE-2026-105728 | High | 7.5 | 2026-10-13 | Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. |
CVE-2026-105727 | High | 8.8 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges… |
CVE-2026-105725 | High | 7.0 | 2026-10-13 | Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. |
CVE-2026-105723 | High | 7.5 | 2026-10-13 | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-105722 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-105718 | High | 8.8 | 2026-10-13 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-105717 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105716 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105715 | High | 7.5 | 2026-10-13 | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-105714 | High | 7.5 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105599 | High | 7.5 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-105598 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105597 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105596 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105595 | High | 8.8 | 2026-10-13 | Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105593 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105592 | High | 7.5 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105591 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-105013 | High | 7.4 | 2026-10-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-105009 | High | 7.5 | 2026-10-13 | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-105007 | High | 8.8 | 2026-10-13 | An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior t… |
CVE-2026-105005 | High | 8.1 | 2026-10-13 | Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network. |
CVE-2026-105004 | High | 7.8 | 2026-10-13 | Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
CVE-2026-105003 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-104937 | High | 8.1 | 2026-10-13 | Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross… |
CVE-2026-104875 | High | 7.1 | 2026-10-13 | Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint… |
CVE-2026-104344 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-104342 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o… |
CVE-2026-104341 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploita… |
CVE-2026-104340 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-103967 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploita… |
CVE-2026-103966 | High | 7.8 | 2026-10-13 | Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-103577 | High | 7.5 | 2026-10-13 | Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-103575 | High | 8.8 | 2026-10-13 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-103572 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attac… |
CVE-2026-103569 | High | 7.5 | 2026-10-13 | Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network. |
CVE-2026-103568 | High | 7.8 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to el… |
CVE-2026-103565 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-103558 | High | 7.5 | 2026-10-13 | Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. |
CVE-2026-103555 | High | 7.0 | 2026-10-13 | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-103554 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-103553 | High | 7.8 | 2026-10-13 | Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-102870 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-102869 | High | 8.8 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-102866 | High | 8.1 | 2026-10-13 | Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-102863 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-102862 | High | 8.8 | 2026-10-13 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-102861 | High | 8.8 | 2026-10-13 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-102860 | High | 8.8 | 2026-10-13 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-102858 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. |
CVE-2026-102857 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. |
CVE-2026-102856 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. |
CVE-2026-102850 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-102849 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
CVE-2026-102599 | High | 7.5 | 2026-10-13 | Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently deri… |
CVE-2026-102233 | High | 7.8 | 2026-10-13 | Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-102232 | High | 7.0 | 2026-10-13 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-102231 | High | 7.7 | 2026-10-13 | Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-102227 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. |
CVE-2026-102226 | High | 8.8 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges… |
CVE-2026-102225 | High | 8.8 | 2026-10-13 | Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. |
CVE-2026-102220 | High | 7.8 | 2026-10-13 | Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-102218 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-102217 | High | 8.8 | 2026-10-13 | Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. |
CVE-2026-102216 | High | 7.8 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-102215 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-102214 | High | 8.8 | 2026-10-13 | Use after free in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-102211 | High | 7.0 | 2026-10-13 | Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2026-102209 | High | 7.0 | 2026-10-13 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-102208 | High | 7.0 | 2026-10-13 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-102207 | High | 7.0 | 2026-10-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2026-102205 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-102204 | High | 7.8 | 2026-10-13 | Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2026-102203 | High | 8.8 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network. |
CVE-2026-102202 | High | 7.8 | 2026-10-13 | Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-102201 | High | 7.8 | 2026-10-13 | Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. |
CVE-2026-102197 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-102196 | High | 7.8 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-102195 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-102194 | High | 7.0 | 2026-10-13 | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |