THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,997 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-96222 — Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform s…
High · CVSS 3.1 7.4 · Assessor: [email protected]
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-96222Read original ↗ (opens in a new tab) - NVD
CVE-2026-96220 — Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevat…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
CVE-2026-96220Read original ↗ (opens in a new tab) - NVD
CVE-2026-96219 — Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute…
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
CVE-2026-96219Read original ↗ (opens in a new tab) - NVD
CVE-2026-96218 — Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
CVE-2026-96218Read original ↗ (opens in a new tab) - NVD
CVE-2026-96217 — Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-96217Read original ↗ (opens in a new tab) - NVD
CVE-2026-96216 — Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96216Read original ↗ (opens in a new tab) - NVD
CVE-2026-96215 — Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an a…
High · CVSS 3.1 7.0 · Assessor: [email protected]
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVE-2026-96215Read original ↗ (opens in a new tab) - NVD
CVE-2026-96209 — Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
CVE-2026-96209Read original ↗ (opens in a new tab) - NVD
CVE-2026-96206 — Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
CVE-2026-96206Read original ↗ (opens in a new tab) - NVD
CVE-2026-96204 — Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
CVE-2026-96204Read original ↗ (opens in a new tab) - NVD
CVE-2026-96202 — Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-96202Read original ↗ (opens in a new tab) - NVD
CVE-2026-96188 — External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileg…
High · CVSS 3.1 7.3 · Assessor: [email protected]
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
CVE-2026-96188Read original ↗ (opens in a new tab) - NVD
CVE-2026-96186 — Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVE-2026-96186Read original ↗ (opens in a new tab) - NVD
CVE-2026-96183 — Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attack…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
CVE-2026-96183Read original ↗ (opens in a new tab) - NVD
CVE-2026-96118 — Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96118Read original ↗ (opens in a new tab) - NVD
CVE-2026-96113 — Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-96113Read original ↗ (opens in a new tab) - NVD
CVE-2026-96108 — Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-96108Read original ↗ (opens in a new tab) - NVD
CVE-2026-96096 — Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
CVE-2026-96096Read original ↗ (opens in a new tab) - NVD
CVE-2026-96071 — Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
CVE-2026-96071Read original ↗ (opens in a new tab) - NVD
CVE-2026-96044 — No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-96044Read original ↗ (opens in a new tab) - NVD
CVE-2026-95943 — Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-95943Read original ↗ (opens in a new tab) - NVD
CVE-2026-95904 — Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-95904Read original ↗ (opens in a new tab) - NVD
CVE-2026-95631 — Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in th…
High · CVSS 3.1 8.7 · Assessor: [email protected]
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-95631Read original ↗ (opens in a new tab) - NVD
CVE-2026-95630 — Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A l…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
CVE-2026-95630Read original ↗ (opens in a new tab) - NVD
CVE-2026-94506 — Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
CVE-2026-94506Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.