Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-70150 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70151 | high | 7.8 | No | Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70156 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70157 | critical | 9.8 | No | Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70158 | high | 8.8 | No | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 2026-10-28 |
| CVE-2026-70115 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70116 | medium | 4.2 | No | Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to bypass a security feature with a phys... | 2026-10-28 |
| CVE-2026-70118 | high | 7.0 | No | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70208 | medium | 5.5 | No | Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70210 | high | 8.8 | No | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network. | 2026-10-28 |
| CVE-2026-70212 | high | 7.0 | No | Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate priv... | 2026-10-28 |
| CVE-2026-96865 | medium | 5.6 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to di... | 2026-10-28 |
| CVE-2026-96864 | critical | 9.8 | No | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-96866 | high | 7.5 | No | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | 2026-10-28 |
| CVE-2026-96863 | medium | 6.8 | No | Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 2026-10-28 |
| CVE-2026-96862 | high | 7.8 | No | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-96861 | high | 7.5 | No | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | 2026-10-28 |
| CVE-2026-88141 | high | 7.0 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-88139 | high | 7.0 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-69988 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-28 |