Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85358 | high | 7.8 | No | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-85359 | high | 7.8 | No | Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges... | 2026-10-28 |
| CVE-2026-70272 | high | 7.0 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-85361 | high | 7.0 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70270 | medium | 5.5 | No | Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70261 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to d... | 2026-10-28 |
| CVE-2026-70260 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to d... | 2026-10-28 |
| CVE-2026-70258 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70234 | medium | 5.5 | No | Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70252 | high | 7.0 | No | Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70229 | high | 8.1 | No | Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70228 | high | 7.8 | No | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70207 | high | 7.5 | No | Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70250 | high | 8.8 | No | Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network. | 2026-10-28 |
| CVE-2026-70153 | critical | 9.8 | No | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70147 | critical | 9.8 | No | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-85364 | high | 7.0 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70123 | high | 7.8 | No | Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-85366 | high | 7.8 | No | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-85367 | high | 7.0 | No | Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally. | 2026-10-28 |