Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-70006 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70138 | high | 7.8 | No | Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70139 | high | 7.8 | No | Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70140 | high | 7.0 | No | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70148 | medium | 6.5 | No | Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70149 | high | 8.8 | No | Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to... | 2026-10-28 |
| CVE-2026-70150 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70151 | high | 7.8 | No | Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70156 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70157 | critical | 9.8 | No | Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70158 | high | 8.8 | No | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 2026-10-28 |
| CVE-2026-70115 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70116 | medium | 4.2 | No | Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to bypass a security feature with a phys... | 2026-10-28 |
| CVE-2026-70118 | high | 7.0 | No | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70208 | medium | 5.5 | No | Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70210 | high | 8.8 | No | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network. | 2026-10-28 |
| CVE-2026-70212 | high | 7.0 | No | Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate priv... | 2026-10-28 |
| CVE-2026-96865 | medium | 5.6 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to di... | 2026-10-28 |
| CVE-2026-96864 | critical | 9.8 | No | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-96866 | high | 7.5 | No | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | 2026-10-28 |