THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,997 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-97003 — Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97003Read original ↗ (opens in a new tab) - NVD
CVE-2026-97001 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-97001Read original ↗ (opens in a new tab) - NVD
CVE-2026-96997 — Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
CVE-2026-96997Read original ↗ (opens in a new tab) - NVD
CVE-2026-96996 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-96996Read original ↗ (opens in a new tab) - NVD
CVE-2026-96995 — Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
CVE-2026-96995Read original ↗ (opens in a new tab) - NVD
CVE-2026-96960 — Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96960Read original ↗ (opens in a new tab) - NVD
CVE-2026-96959 — Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96959Read original ↗ (opens in a new tab) - NVD
CVE-2026-96958 — Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96958Read original ↗ (opens in a new tab) - NVD
CVE-2026-96957 — Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96957Read original ↗ (opens in a new tab) - NVD
CVE-2026-96953 — Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
CVE-2026-96953Read original ↗ (opens in a new tab) - NVD
CVE-2026-96952 — Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a netw…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVE-2026-96952Read original ↗ (opens in a new tab) - NVD
CVE-2026-96951 — Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96951Read original ↗ (opens in a new tab) - NVD
CVE-2026-96950 — Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privilege…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96950Read original ↗ (opens in a new tab) - NVD
CVE-2026-96949 — Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privilege…
High · CVSS 3.1 7.0 · Assessor: [email protected]
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96949Read original ↗ (opens in a new tab) - NVD
CVE-2026-96948 — Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authori…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
CVE-2026-96948Read original ↗ (opens in a new tab) - NVD
CVE-2026-96947 — Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privilege…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96947Read original ↗ (opens in a new tab) - NVD
CVE-2026-96946 — Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privilege…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96946Read original ↗ (opens in a new tab) - NVD
CVE-2026-96945 — Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CVE-2026-96945Read original ↗ (opens in a new tab) - NVD
CVE-2026-96944 — Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized atta…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.
CVE-2026-96944Read original ↗ (opens in a new tab) - NVD
CVE-2026-96943 — Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-96943Read original ↗ (opens in a new tab) - NVD
CVE-2026-96939 — Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privil…
High · CVSS 3.1 7.0 · Assessor: [email protected]
Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVE-2026-96939Read original ↗ (opens in a new tab) - NVD
CVE-2026-96938 — Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges loca…
Medium · CVSS 3.1 6.7 · Assessor: [email protected]
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96938Read original ↗ (opens in a new tab) - NVD
CVE-2026-96937 — Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-96937Read original ↗ (opens in a new tab) - NVD
CVE-2026-96935 — Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-96935Read original ↗ (opens in a new tab) - NVD
CVE-2026-96934 — Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-96934Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.