High-severity CVEs (page 47)
Page 47 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55002 | High | 8.8 | 2026-07-14 | External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-55001 | High | 7.8 | 2026-07-14 | Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally. |
CVE-2026-54999 | High | 8.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code o… |
CVE-2026-54996 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-54995 | High | 8.1 | 2026-07-14 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. |
CVE-2026-54993 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally. |
CVE-2026-54992 | High | 8.4 | 2026-07-14 | Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally. |
CVE-2026-54991 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-54989 | High | 7.0 | 2026-07-14 | Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. |
CVE-2026-54987 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
CVE-2026-54986 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-54983 | High | 7.5 | 2026-07-14 | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
CVE-2026-54982 | High | 8.8 | 2026-07-14 | Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-54433 | High | 7.2 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-cont… |
CVE-2026-54129 | High | 7.0 | 2026-07-14 | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-54127 | High | 7.4 | 2026-07-14 | Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-54122 | High | 8.4 | 2026-07-14 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. |
CVE-2026-54119 | High | 7.5 | 2026-07-14 | Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-54118 | High | 8.8 | 2026-07-14 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-54117 | High | 8.8 | 2026-07-14 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-54114 | High | 7.8 | 2026-07-14 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-54112 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileg… |
CVE-2026-54111 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-54109 | High | 7.8 | 2026-07-14 | Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. |
CVE-2026-54107 | High | 8.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileg… |
CVE-2026-50697 | High | 7.8 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-50696 | High | 7.5 | 2026-07-14 | Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2026-50695 | High | 7.5 | 2026-07-14 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. |
CVE-2026-50694 | High | 8.1 | 2026-07-14 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
CVE-2026-50675 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-50663 | High | 8.8 | 2026-07-14 | Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. |
CVE-2026-50653 | High | 7.5 | 2026-07-14 | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-50652 | High | 7.5 | 2026-07-14 | Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-50520 | High | 8.4 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code local… |
CVE-2026-50506 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-50384 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Service allows an authorized attacker to elevate pr… |
CVE-2026-50364 | High | 7.3 | 2026-07-14 | Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally. |
CVE-2026-50356 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to ele… |
CVE-2026-50354 | High | 7.1 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50351 | High | 7.8 | 2026-07-14 | Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50342 | High | 8.8 | 2026-07-14 | Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-50338 | High | 8.2 | 2026-07-14 | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. |
CVE-2026-50333 | High | 7.8 | 2026-07-14 | Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-50325 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-50323 | High | 7.0 | 2026-07-14 | Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally. |
CVE-2026-50318 | High | 7.8 | 2026-07-14 | Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50311 | High | 7.8 | 2026-07-14 | Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-50308 | High | 7.8 | 2026-07-14 | Integer underflow (wrap or wraparound) in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-50297 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-50296 | High | 7.0 | 2026-07-14 | Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50293 | High | 7.8 | 2026-07-14 | Use after free in Windows Internal Task Bar allows an authorized attacker to elevate privileges locally. |
CVE-2026-49808 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2026-49806 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-49805 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-49803 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to… |
CVE-2026-49802 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-49800 | High | 7.8 | 2026-07-14 | Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally. |
CVE-2026-49797 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-49796 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. |
CVE-2026-49795 | High | 8.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-49793 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. |
CVE-2026-49792 | High | 7.8 | 2026-07-14 | Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. |
CVE-2026-49791 | High | 7.1 | 2026-07-14 | Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate pri… |
CVE-2026-49790 | High | 7.3 | 2026-07-14 | Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability |
CVE-2026-49789 | High | 7.3 | 2026-07-14 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-49788 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network. |
CVE-2026-49787 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2026-49784 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to ele… |
CVE-2026-49783 | High | 7.8 | 2026-07-14 | Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-49184 | High | 8.4 | 2026-07-14 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-49183 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard Server allows an authorized attacker to elevat… |
CVE-2026-49181 | High | 7.5 | 2026-07-14 | Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-49178 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network. |
CVE-2026-49176 | High | 7.8 | 2026-07-14 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. |
CVE-2026-49175 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-49173 | High | 7.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-49171 | High | 7.5 | 2026-07-14 | Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2026-49170 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-49169 | High | 8.0 | 2026-07-14 | Use after free in DNS Server allows an authorized attacker to execute code over a network. |
CVE-2026-49166 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally. |
CVE-2026-49165 | High | 7.1 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. |
CVE-2026-49164 | High | 8.1 | 2026-07-14 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. |
CVE-2026-49162 | High | 7.0 | 2026-07-14 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-48581 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally. |
CVE-2026-48572 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate p… |
CVE-2026-48571 | High | 7.0 | 2026-07-14 | Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-48564 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. |
CVE-2026-47632 | High | 8.8 | 2026-07-14 | Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-47296 | High | 7.5 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-45646 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-44800 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-42982 | High | 7.8 | 2026-07-14 | Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
CVE-2026-42975 | High | 8.0 | 2026-07-14 | Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-42900 | High | 8.1 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate pri… |
CVE-2026-40400 | High | 8.0 | 2026-07-14 | Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network. |
CVE-2026-40378 | High | 7.5 | 2026-07-14 | Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over… |
CVE-2026-15703 | High | 7.3 | 2026-07-14 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproduct… |
CVE-2026-15429 | High | 8.8 | 2026-07-14 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow new… |
CVE-2026-15428 | High | 8.8 | 2026-07-14 | An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who… |
CVE-2026-15427 | High | 8.1 | 2026-07-14 | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitizati… |