Microsoft Makers of the Windows Operating System and hundreds of products that run on it.

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Microsoft product.

RSS Feeds for Microsoft security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Microsoft products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Microsoft Sorted by Most Security Vulnerabilities since 2018

Microsoft Windows 106761 vulnerabilities

Microsoft Windows Server 20196439 vulnerabilities

Microsoft Windows Server 20166133 vulnerabilities

Microsoft Windows Server 20224886 vulnerabilities

Microsoft Windows Server 20124652 vulnerabilities

Microsoft Windows Server 20253572 vulnerabilities

Microsoft Windows 11 24h23495 vulnerabilities

Microsoft Windows 11 23h23348 vulnerabilities

Microsoft Windows Server 2012 R22883 vulnerabilities

Microsoft Windows Server 20082820 vulnerabilities

Microsoft Windows 11 25h22660 vulnerabilities

Microsoft Windows 11 26h12491 vulnerabilities

Microsoft Windows 112283 vulnerabilities

Microsoft Windows 71811 vulnerabilities

Microsoft Windows 8.11715 vulnerabilities

Microsoft Windows 10 15071680 vulnerabilities

Microsoft Windows Rt 8 11592 vulnerabilities

Microsoft Windows Server 23h21431 vulnerabilities

Microsoft Windows Server 2022 23h21115 vulnerabilities

Microsoft Windows Server 2008 R21100 vulnerabilities

Microsoft Windows932 vulnerabilities

Microsoft Windows Server 2008 Sp2904 vulnerabilities

Microsoft 365 Apps882 vulnerabilities

Microsoft Windows 11 Version 26h2 Arm64 Based Systems864 vulnerabilities

Microsoft Windows Server655 vulnerabilities

Microsoft Office614 vulnerabilities

Microsoft Office 2024612 vulnerabilities

Microsoft Office 2021611 vulnerabilities

Microsoft Sharepoint Server560 vulnerabilities

Microsoft Internet Explorer (IE)528 vulnerabilities
Popular web browser for windows

Microsoft Windows 10 1909522 vulnerabilities

Microsoft Office Macos 2021518 vulnerabilities

Microsoft Office Macos 2024514 vulnerabilities

Microsoft Office 2019509 vulnerabilities

Microsoft Windows Server 2004434 vulnerabilities

Microsoft Edge Browser429 vulnerabilities
Web Browser based on Chromium

Microsoft Windows Server 20h2399 vulnerabilities

Microsoft Windows Vista382 vulnerabilities

Microsoft Office 365367 vulnerabilities

Microsoft Windows Server 1909344 vulnerabilities

Microsoft Edge Chromium338 vulnerabilities

Microsoft Windows XP326 vulnerabilities

Microsoft Windows Server 1903317 vulnerabilities

Microsoft Windows 10 1803279 vulnerabilities

Microsoft Windows 10 21h1269 vulnerabilities

Microsoft Windows Server 2003262 vulnerabilities

Microsoft Office Long Term Servicing Channel219 vulnerabilities

Microsoft Sql Server 2019212 vulnerabilities

Microsoft Sharepoint Server 2019206 vulnerabilities

Microsoft Sharepoint Server 2016200 vulnerabilities

Microsoft Visual Studio 2022197 vulnerabilities

Microsoft Excel194 vulnerabilities
Spreadsheet Software

Microsoft Sql Server 2022186 vulnerabilities

Microsoft Excel 2016184 vulnerabilities

Microsoft Net180 vulnerabilities

Microsoft Windows Server 1803171 vulnerabilities

Microsoft Office 2016168 vulnerabilities

Microsoft Windows 2003 Server162 vulnerabilities

Microsoft Sql Server 2017156 vulnerabilities

Microsoft Office Online Server135 vulnerabilities

Microsoft Exchange Server132 vulnerabilities

Microsoft Visual Studio 2019126 vulnerabilities

Microsoft Windows 2000112 vulnerabilities

Microsoft Windows 11 2h2110 vulnerabilities

Microsoft SQL Server106 vulnerabilities
Database Server

Microsoft Dynamics 365105 vulnerabilities

Microsoft Word104 vulnerabilities

Microsoft Visual Studio Code101 vulnerabilities
VSCode Developer IDE

Microsoft Visual Studio97 vulnerabilities
Developer IDE

Microsoft Sql Server 201697 vulnerabilities

Microsoft Visual Studio 201797 vulnerabilities

Microsoft Word 201694 vulnerabilities

Microsoft Sql Server 202592 vulnerabilities

Microsoft Office 365 Proplus87 vulnerabilities

Microsoft Outlook86 vulnerabilities

Microsoft Windows 11 Version 26h2 X64 Based Systems64 vulnerabilities

Microsoft .NET Framework63 vulnerabilities

Microsoft Office Compatibility Pack61 vulnerabilities

Microsoft Windows 861 vulnerabilities

Microsoft Exchange Server 201657 vulnerabilities

Microsoft Windows Nt57 vulnerabilities

Microsoft Office Web Apps55 vulnerabilities

Microsoft Powershell54 vulnerabilities

Microsoft Azure Site Recovery53 vulnerabilities

Microsoft Exchange Server 201951 vulnerabilities

Microsoft ASP.NET Core46 vulnerabilities

Microsoft Exchange Server Se46 vulnerabilities

Microsoft Windows Rt46 vulnerabilities

Microsoft Hevc Video Extensions44 vulnerabilities

Microsoft Visual Studio 202642 vulnerabilities

Microsoft Office Web Apps Server42 vulnerabilities

Microsoft Http Server41 vulnerabilities

Microsoft Windows 10 170940 vulnerabilities

Microsoft Azure Devops Server40 vulnerabilities

Microsoft 39 vulnerabilities

Microsoft Remote Desktop39 vulnerabilities

Microsoft Visual Studio 2026 Version 18 1039 vulnerabilities

Microsoft Mysql36 vulnerabilities

Microsoft Teams35 vulnerabilities

Microsoft .NET Core35 vulnerabilities

Recent Microsoft Security Advisories

Advisory	Title	Published
CVE-2026-118313	Chromium: CVE-2026-118313 Use after free in Video	October 31, 2026
CVE-2026-118316	Chromium: CVE-2026-118316 Improper input validation in V8	October 31, 2026
CVE-2026-118318	Chromium: CVE-2026-118318 Improper access control in V8	October 31, 2026
CVE-2026-91732	Chromium CVE-2026-91732: Missing authorization	October 31, 2026
CVE-2026-118312	Chromium: CVE-2026-118312 Memory corruption in Paint	October 31, 2026
CVE-2026-118311	Chromium: CVE-2026-118311 Memory corruption in Media	October 31, 2026
CVE-2026-118317	Chromium: CVE-2026-118317 Memory corruption in HTML	October 31, 2026
CVE-2026-118315	Chromium: CVE-2026-118315 Improper input validation in SVG	October 31, 2026
CVE-2026-118308	Chromium: CVE-2026-118308 Use after free in SVG	October 31, 2026
CVE-2026-118310	Chromium: CVE-2026-118310 Improper input validation in Views	October 31, 2026

Known Exploited Microsoft Vulnerabilities

The following Microsoft vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Microsoft Windows Command Injection Vulnerability	Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-96951	October 13, 2026
Microsoft SharePoint Code Injection Vulnerability	Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. CVE-2026-65660	September 25, 2026
Microsoft Windows Heap-Based Buffer Overflow Vulnerability	Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. CVE-2026-85880	September 8, 2026
Microsoft Windows Link Following Vulnerability	Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CVE-2026-81963	September 8, 2026
Microsoft SQL Server Remote Code Execution Vulnerability	Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CVE-2019-1068 Exploit Probability: 57.3%	August 26, 2026
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability	Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. CVE-2026-33824 Exploit Probability: 55.9%	August 18, 2026
Microsoft SharePoint Weak Authentication Vulnerability	Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-55040 Exploit Probability: 1.3%	August 18, 2026
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-68820	August 11, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. CVE-2026-50522 Exploit Probability: 57.1%	July 22, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CVE-2026-58644	July 16, 2026
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerabil	Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-56155 Exploit Probability: 2.3%	July 14, 2026
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability	Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. CVE-2026-56164 Exploit Probability: 18.4%	July 14, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CVE-2026-45659 Exploit Probability: 9.1%	July 1, 2026
Microsoft Defender Denial of Service Vulnerability	Microsoft Defender contains an unspecified vulnerability that allows for denial of service. CVE-2026-45498 Exploit Probability: 63.1%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0249 Exploit Probability: 91.9%	May 20, 2026
Microsoft Defender Link Following Vulnerability	Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-41091 Exploit Probability: 9.6%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0806 Exploit Probability: 82.2%	May 20, 2026
Microsoft DirectX NULL Byte Overwrite Vulnerability	Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. CVE-2009-1537 Exploit Probability: 51.4%	May 20, 2026
Microsoft Windows Buffer Overflow Vulnerability	Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. CVE-2008-4250 Exploit Probability: 98.8%	May 20, 2026
Microsoft Exchange Server Cross-Site Scripting Vulnerability	Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. CVE-2026-42897 Exploit Probability: 5.6%	May 15, 2026

Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 4 known exploited Microsoft vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Microsoft Vulnerabilities

Based on the current exploit probability, these Microsoft vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2021-34473	100.0%	Microsoft Exchange Server Remote Code Execution Vulnerability
2	CVE-2019-0708	100.0%	"BlueKeep" Microsoft Windows Remote Desktop Remote Code Execution Vulnerability
3	CVE-2015-1635	100.0%	Microsoft HTTP.sys Remote Code Execution Vulnerability
4	CVE-2025-53770	100.0%	Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
5	CVE-2021-26855	100.0%	Microsoft OWA Exchange Control Panel (ECP) Exploit Chain
6	CVE-2025-49704	100.0%	Microsoft SharePoint Code Injection Vulnerability
7	CVE-2021-34523	100.0%	Microsoft Exchange Server Privilege Escalation Vulnerability
8	CVE-2023-29357	100.0%	Microsoft SharePoint Server Privilege Escalation Vulnerability
9	CVE-2025-59287	100.0%	Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
10	CVE-2012-0158	100.0%	Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

By the Year

In 2026 there have been 8467 vulnerabilities in Microsoft with an average score of 7.3 out of ten. Last year, in 2025 Microsoft had 2759 security vulnerabilities published. That is, 5708 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.04.

Year	Vulnerabilities	Average Score
2026	8467	7.27
2025	2759	7.23
2024	2182	7.39
2023	1695	7.21
2022	1389	7.43
2021	1153	7.44
2020	1253	7.19
2019	831	7.08
2018	661	7.03

It may take a day or so for new Microsoft vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Microsoft Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-69446	Oct 30, 2026	Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.	Edge Chromium
CVE-2026-88078	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	Edge Chromium
CVE-2026-88077	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.	Edge Chromium
CVE-2026-96196	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.	Edge Chromium
CVE-2026-96187	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.	Edge Chromium
CVE-2026-85330	Oct 29, 2026	Oct 2026: Microsoft Edge for Android Security Feature Bypass Vulnerability Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.	Edge Chromium
CVE-2026-85899	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.	Edge Chromium
CVE-2026-88090	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.	Edge Chromium
CVE-2026-20942	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	Edge Chromium
CVE-2026-96203	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.	Edge Chromium
CVE-2026-96192	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-96199	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-96198	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-85897	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-85890	Oct 29, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-62765	Oct 27, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-85898	Oct 27, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-83831	Oct 27, 2026	Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-83938	Oct 22, 2026	Oct 2026: Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.	Azure Kubernetes Configuration Service
CVE-2026-96185	Oct 22, 2026	Oct 2026: Microsoft Exchange Online Remote Code Execution Vulnerability Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.	Exchange Online
CVE-2026-97785	Oct 22, 2026	Oct 2026: AAD App Proxy Elevation of Privilege Vulnerability Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.	Entra Application Proxy
CVE-2026-80092	Oct 16, 2026	Oct 2026: Microsoft Identity Web Elevation of Privilege Vulnerability Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.	Microsoft Identity Web
CVE-2026-92707	Oct 15, 2026	DoS via PrimitiveObjectFormatter in MessagePack for C# before 2.5.303/3.1.9 MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.
CVE-2026-88164	Oct 14, 2026	Oct 2026: Microsoft Office SharePoint Elevation of Privilege Vulnerability Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.	Sharepoint Server
CVE-2026-94520	Oct 13, 2026	Oct 2026: Microsoft SQL Server Denial of Service Vulnerability Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2022 Microsoft Sql Server 2019 X64 Based Systems Cu32 And others...
CVE-2026-94512	Oct 13, 2026	Oct 2026: SQL Server Remote Code Execution Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.	Microsoft Sql Server 2022 X64 Based Systems Cu27 Microsoft Sql Server 2025 X64 Based Systems Cu9 Sql Server 2017 And others...
CVE-2026-88089	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Microsoft Sql Server 2019 X64 Based Systems Cu32 Sql Server 2025 And others...
CVE-2026-88088	Oct 13, 2026	Oct 2026: Microsoft SQL Server Elevation of Privilege Vulnerability Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.	Sql Server 2019 Sql Server 2022 Sql Server 2025 And others...
CVE-2026-88086	Oct 13, 2026	Oct 2026: Microsoft SQL Server Information Disclosure Vulnerability Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.	Microsoft Sql Server 2019 X64 Based Systems Cu32 Microsoft Sql Server 2022 X64 Based Systems Cu27 Microsoft Sql Server 2025 X64 Based Systems Cu9 And others...
CVE-2026-88085	Oct 13, 2026	Oct 2026: Microsoft SQL Server Elevation of Privilege Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2017 Sql Server 2019 And others...
CVE-2026-88084	Oct 13, 2026	Oct 2026: Microsoft SQL Server Denial of Service Vulnerability Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.	Microsoft Sql Server 2019 X64 Based Systems Cu32 Sql Server 2019 Sql Server 2025 And others...
CVE-2026-85919	Oct 13, 2026	Oct 2026: Microsoft SQL Server Elevation of Privilege Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.	Microsoft Sql Server 2022 X64 Based Systems Cu27 Microsoft Sql Server 2025 X64 Based Systems Cu9 Sql Server 2025 And others...
CVE-2026-88083	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.	Sql Server 2022 Sql Server 2025 Microsoft Sql Server 2022 X64 Based Systems Cu27 And others...
CVE-2026-88082	Oct 13, 2026	Oct 2026: Microsoft SQL Server Elevation of Privilege Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.	Sql Server 2022 Sql Server 2025 Sql Server 2019 And others...
CVE-2026-88081	Oct 13, 2026	Oct 2026: Microsoft SQL Server Information Disclosure Vulnerability Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2025 Sql Server 2017 And others...
CVE-2026-85888	Oct 13, 2026	Oct 2026: Microsoft SQL Server Information Disclosure Vulnerability Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.	Sql Server 2017 Sql Server 2019 Sql Server 2022 And others...
CVE-2026-62840	Oct 13, 2026	Oct 2026: Linux Kernel Elevation of Privilege Vulnerability Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.	Linux 3p Third Party Distros Linux Kernel Mana Network Driver
CVE-2026-65674	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.	Microsoft Sql Server 2022 X64 Based Systems Cu27 Microsoft Sql Server 2025 X64 Based Systems Cu9 Sql Server 2019 And others...
CVE-2026-67626	Oct 13, 2026	Oct 2026: Microsoft SQL Server Denial of Service Vulnerability Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.	Microsoft Sql Server 2022 X64 Based Systems Cu27 Microsoft Sql Server 2025 X64 Based Systems Cu9 Sql Server 2022 And others...
CVE-2026-67628	Oct 13, 2026	Oct 2026: Microsoft SQL Server Information Disclosure Vulnerability Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.	Sql Server 2017 Sql Server 2019 Sql Server 2022 And others...
CVE-2026-83945	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.	Sql Server 2025 Sql Server 2022 Microsoft Sql Server 2022 X64 Based Systems Cu27 And others...
CVE-2026-85876	Oct 13, 2026	Oct 2026: Microsoft SQL Server Elevation of Privilege Vulnerability Use after free in SQL Server allows an authorized attacker to elevate privileges locally.	Sql Server 2019 Microsoft Sql Server 2019 X64 Based Systems Cu32 Sql Server 2025 And others...
CVE-2026-68883	Oct 13, 2026	Oct 2026: Microsoft SQL Server Elevation of Privilege Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2025 Sql Server 2017 And others...
CVE-2026-70189	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2017 Sql Server 2019 And others...
CVE-2026-85886	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2025 Sql Server 2017 And others...
CVE-2026-67625	Oct 13, 2026	Oct 2026: Microsoft SQL Server Remote Code Execution Vulnerability Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2017 Sql Server 2019 And others...
CVE-2026-96956	Oct 13, 2026	Oct 2026: SQL Server Elevation of Privilege Vulnerability Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.	Microsoft Sql Server 2017 X64 Based Systems Cu31 Sql Server 2017 Sql Server 2019 And others...
CVE-2026-97781	Oct 13, 2026	Oct 2026: Microsoft Office OneNote Remote Code Execution Vulnerability Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.	365 Apps
CVE-2026-97801	Oct 13, 2026	Oct 2026: .NET Framework Tampering Vulnerability Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.	Net .NET Framework
CVE-2026-97835	Oct 13, 2026	Oct 2026: Role: DNS Server Information Disclosure Vulnerability Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.	Windows Server 2012 Windows Server 2012 R2 Windows 10 And others...