2026 CVEs (page 128)
Page 128 of 665 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73022 | High | 7.0 | 2026-09-08 | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-73021 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73020 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73019 | Medium | 4.3 | 2026-09-08 | Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-73018 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. |
CVE-2026-73017 | High | 7.5 | 2026-09-08 | Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally. |
CVE-2026-73016 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2026-73015 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73014 | High | 7.8 | 2026-09-08 | Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. |
CVE-2026-73013 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
CVE-2026-73012 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network. |
CVE-2026-73011 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73010 | Critical | 9.8 | 2026-09-08 | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. |
CVE-2026-73009 | Critical | 9.8 | 2026-09-08 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
CVE-2026-73008 | Medium | 5.5 | 2026-09-08 | Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally. |
CVE-2026-73007 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73006 | High | 8.8 | 2026-09-08 | Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2026-73005 | High | 7.0 | 2026-09-08 | Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2026-73004 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally. |
CVE-2026-73003 | High | 7.0 | 2026-09-08 | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-73002 | High | 7.8 | 2026-09-08 | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73001 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-73000 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72999 | Medium | 6.8 | 2026-09-08 | Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-72997 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72996 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72995 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72994 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72993 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72992 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72991 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72990 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72989 | High | 7.5 | 2026-09-08 | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72988 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72987 | High | 8.1 | 2026-09-08 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. |
CVE-2026-72986 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. |
CVE-2026-72985 | Medium | 6.8 | 2026-09-08 | Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-72983 | Critical | 9.8 | 2026-09-08 | Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-72982 | Critical | 9.8 | 2026-09-08 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
CVE-2026-72981 | High | 8.1 | 2026-09-08 | Use after free in IP Helper allows an unauthorized attacker to execute code over a network. |
CVE-2026-72980 | Medium | 4.4 | 2026-09-08 | Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally. |
CVE-2026-72979 | Critical | 9.8 | 2026-09-08 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-72978 | Medium | 5.9 | 2026-09-08 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
CVE-2026-72977 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72976 | Medium | 5.0 | 2026-09-08 | Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally. |
CVE-2026-72975 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72974 | Medium | 6.5 | 2026-09-08 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72973 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-72972 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-72967 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
CVE-2026-72966 | Medium | 5.5 | 2026-09-08 | Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally. |
CVE-2026-72965 | High | 7.8 | 2026-09-08 | Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72964 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally. |
CVE-2026-72963 | High | 7.0 | 2026-09-08 | Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-72962 | High | 8.2 | 2026-09-08 | Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-72961 | High | 8.2 | 2026-09-08 | Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-72960 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. |
CVE-2026-72959 | High | 8.8 | 2026-09-08 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
CVE-2026-72958 | High | 8.2 | 2026-09-08 | Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally. |
CVE-2026-72957 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally. |
CVE-2026-72956 | Medium | 6.5 | 2026-09-08 | Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72954 | High | 7.5 | 2026-09-08 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. |
CVE-2026-72953 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-72952 | High | 7.0 | 2026-09-08 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally. |
CVE-2026-72950 | High | 8.8 | 2026-09-08 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
CVE-2026-72949 | High | 7.5 | 2026-09-08 | Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network. |
CVE-2026-72948 | Medium | 6.7 | 2026-09-08 | Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-72947 | Medium | 6.4 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72946 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Storage Port Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-72945 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
CVE-2026-72944 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72943 | High | 7.5 | 2026-09-08 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. |
CVE-2026-72942 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72941 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-72940 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker to execute code over a network. |
CVE-2026-72939 | Medium | 6.5 | 2026-09-08 | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network. |
CVE-2026-72938 | Medium | 6.5 | 2026-09-08 | Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a net… |
CVE-2026-72937 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2026-72936 | High | 8.1 | 2026-09-08 | Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-72935 | Medium | 6.7 | 2026-09-08 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-72933 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. |
CVE-2026-72932 | High | 7.5 | 2026-09-08 | Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72931 | Medium | 4.7 | 2026-09-08 | Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally. |
CVE-2026-72930 | High | 7.0 | 2026-09-08 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally. |
CVE-2026-72929 | High | 7.8 | 2026-09-08 | Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-72928 | High | 7.5 | 2026-09-08 | Use after free in Windows DNS allows an authorized attacker to execute code over a network. |
CVE-2026-72927 | Medium | 6.7 | 2026-09-08 | Heap-based buffer overflow in Winsock allows an authorized attacker to elevate privileges locally. |
CVE-2026-72926 | High | 7.0 | 2026-09-08 | Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-72923 | High | 7.5 | 2026-09-08 | In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML… |
CVE-2026-71353 | High | 7.0 | 2026-09-08 | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-71352 | High | 8.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authorized attacker to execute code over a network. |
CVE-2026-71351 | High | 7.0 | 2026-09-08 | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-71350 | Medium | 6.8 | 2026-09-08 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-71349 | Medium | 6.8 | 2026-09-08 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-71348 | Medium | 6.8 | 2026-09-08 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-71345 | High | 7.8 | 2026-09-08 | Out-of-bounds write in Windows Spaceport.sys allows an authorized attacker to execute code locally. |
CVE-2026-71343 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally. |
CVE-2026-71342 | High | 7.0 | 2026-09-08 | Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-71341 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to disclose information locally. |
CVE-2026-71340 | High | 7.0 | 2026-09-08 | Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. |