Browse CVEs

HIGH 7.1 CVE-2026-40401 Windows TCP/IP Denial of Service Vulnerability Windows 10 1607 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,9502026-05-12 HIGH 8.8 CVE-2026-40370 External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. Sql Server 2016 13.0.6490.1 / 13.0.7085.1+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-40369 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. Windows 11 24h2 10.0.26100.8390 / 10.0.26100.32772+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-40377 Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. Windows 10 1607 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-40381 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. Azure Connected Machine Agent 1.63+ Fix from $1,9502026-05-12 HIGH 7.5 CVE-2026-40379 Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. Entra Id No fix yet Fix from $1,9502026-05-12 MEDIUM 6.5 CVE-2026-40374 Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network. Power Automate For Desktop 2.67+ Fix from $1,6002026-05-12 MEDIUM 6.2 CVE-2026-40380 Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. Windows 10 1607 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,6002026-05-12 HIGH 8.8 CVE-2026-40365 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Sharepoint Server 16.0.19725.20280+ Fix from $1,9502026-05-12 HIGH 8.4 CVE-2026-40363 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. 365 Apps 16.0.19822.20190+ Fix from $1,9502026-05-12 HIGH 8.4 CVE-2026-40364 Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. 365 Apps Mitigation only Fix from $1,9502026-05-12 HIGH 8.4 CVE-2026-40366 Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. 365 Apps Mitigation only Fix from $1,9502026-05-12 HIGH 8.4 CVE-2026-40367 Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. 365 Apps 16.0.19725.20280+ Fix from $1,9502026-05-12 HIGH 8.0 CVE-2026-40368 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Sharepoint Server 16.0.19725.20280+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-40362 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. 365 Apps 16.0.10417.20128+ Fix from $1,9502026-05-12 HIGH 8.8 CVE-2026-35439 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Sharepoint Server 16.0.19725.20280+ Fix from $1,9502026-05-12 HIGH 8.8 CVE-2026-40357 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Sharepoint Server 16.0.19725.20280+ Fix from $1,9502026-05-12 HIGH 8.4 CVE-2026-40358 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. 365 Apps No fix yet Fix from $1,9502026-05-12 HIGH 8.4 CVE-2026-40361 Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. 365 Apps No fix yet Fix from $1,9502026-05-12 HIGH 8.3 CVE-2026-35438 Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. Windows Admin Center 2511+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-40359 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. 365 Apps 16.0.10417.20128+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-40360 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. 365 Apps 16.0.10417.20128+ Fix from $1,9502026-05-12 MEDIUM 5.5 CVE-2026-35440 Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. 365 Apps No fix yet Fix from $1,6002026-05-12 HIGH 8.8 CVE-2026-35436 Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. 365 Apps Mitigation only Fix from $1,9502026-05-12 HIGH 7.5 CVE-2026-35424 Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service ov… Windows 10 1607 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,9502026-05-12 HIGH 7.3 CVE-2026-35433 Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. .net Framework 8.0.27 / 9.0.16+ Fix from $1,9502026-05-12 MEDIUM 5.4 CVE-2026-35423 Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network. Windows 10 1607 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,6002026-05-12 HIGH 7.8 CVE-2026-35417 Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. Windows 10 1809 10.0.17763.8755 / 10.0.19044.7291+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-35420 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. Windows Server 2012 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,9502026-05-12 HIGH 7.8 CVE-2026-35421 Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally. Windows 10 1607 10.0.14393.9140 / 10.0.17763.8755+ Fix from $1,9502026-05-12