CVE-2026-124224

PowerShell Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-122984

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-80094

Remote Desktop Gateway Service Elevation of Privilege Vulnerability

Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2019 Windows Server 2022 and 1 more

CVE-2026-120782

Visual Studio Code Security Feature Bypass Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-114160

Azure Managed Grafana Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Managed Grafana

CVE-2026-123389

Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-123387

Active Directory Domain Services Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-122985

Microsoft PowerShell Information Disclosure Vulnerability

Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Powershell Powershell 7.7

CVE-2026-122979

Microsoft Teams for Android Spoofing Vulnerability

Improper control of generation of code ('code injection') in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Teams

CVE-2026-122196

Microsoft Dynamics 365 (on-premises) Information Disclosure Vulnerability

Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Power-apps

CVE-2026-70003

JDBC Driver for SQL Server Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Jdbc Driver For Sql Server 13.4

CVE-2026-80095

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-88111

SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2022 For X64-based Systems \(cu27\) Sql Server 2025 For X64-based Systems Cu10

CVE-2026-96845

Windows Task Scheduler Elevation of Privilege Vulnerability

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 12 more

CVE-2026-70182

Windows Bind Filter Driver Elevation of Privilege Vulnerability

Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 and 1 more

CVE-2026-83563

Winlogon Elevation of Privilege Vulnerability

Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-85942

Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 22h2 and 8 more

CVE-2026-125761

WordPress YITH WooCommerce Ajax Search plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125445

WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125450

WordPress SureRank plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—