THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
17,045 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-84013 — Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
CVE-2026-84013Read original ↗ (opens in a new tab) - NVD
CVE-2026-84012 — Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.1 · Assessor: [email protected]
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVE-2026-84012Read original ↗ (opens in a new tab) - NVD
CVE-2026-84011 — Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally.
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally.
CVE-2026-84011Read original ↗ (opens in a new tab) - NVD
CVE-2026-84009 — Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform…
Medium · CVSS 3.1 4.7 · Assessor: [email protected]
Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
CVE-2026-84009Read original ↗ (opens in a new tab) - NVD
CVE-2026-84008 — Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-84008Read original ↗ (opens in a new tab) - NVD
CVE-2026-84007 — Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network.
CVE-2026-84007Read original ↗ (opens in a new tab) - NVD
CVE-2026-83935 — Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.
CVE-2026-83935Read original ↗ (opens in a new tab) - NVD
CVE-2026-83934 — Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
CVE-2026-83934Read original ↗ (opens in a new tab) - NVD
CVE-2026-83933 — Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized a…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.
CVE-2026-83933Read original ↗ (opens in a new tab) - NVD
CVE-2026-83932 — Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.
CVE-2026-83932Read original ↗ (opens in a new tab) - NVD
CVE-2026-83931 — Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVE-2026-83931Read original ↗ (opens in a new tab) - NVD
CVE-2026-83930 — Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83930Read original ↗ (opens in a new tab) - NVD
CVE-2026-83929 — Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
CVE-2026-83929Read original ↗ (opens in a new tab) - NVD
CVE-2026-83928 — Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
CVE-2026-83928Read original ↗ (opens in a new tab) - NVD
CVE-2026-83927 — Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.
CVE-2026-83927Read original ↗ (opens in a new tab) - NVD
CVE-2026-83926 — Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.
Medium · CVSS 3.1 4.4 · Assessor: [email protected]
Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.
CVE-2026-83926Read original ↗ (opens in a new tab) - NVD
CVE-2026-83925 — Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
Medium · CVSS 3.1 4.7 · Assessor: [email protected]
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-83925Read original ↗ (opens in a new tab) - NVD
CVE-2026-83924 — Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-83924Read original ↗ (opens in a new tab) - NVD
CVE-2026-83923 — Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CVE-2026-83923Read original ↗ (opens in a new tab) - NVD
CVE-2026-83922 — Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVE-2026-83922Read original ↗ (opens in a new tab) - NVD
CVE-2026-83921 — Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-83921Read original ↗ (opens in a new tab) - NVD
CVE-2026-83920 — Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-83920Read original ↗ (opens in a new tab) - NVD
CVE-2026-83919 — Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.
CVE-2026-83919Read original ↗ (opens in a new tab) - NVD
CVE-2026-83918 — Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.8 · Assessor: [email protected]
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-83918Read original ↗ (opens in a new tab) - NVD
CVE-2026-83917 — Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.
CVE-2026-83917Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.