CVE-2026-84010

Microsoft SQL Server Elevation of Privilege Vulnerability

Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-109469

Entra Device Registration Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Entra Device Registration

CVE-2026-125135

HID Parser Library Elevation of Privilege Vulnerability

Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-120782

Visual Studio Code Security Feature Bypass Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-114160

Azure Managed Grafana Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Managed Grafana

CVE-2026-122979

Microsoft Teams for Android Spoofing Vulnerability

Improper control of generation of code ('code injection') in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Teams

CVE-2026-122196

Microsoft Dynamics 365 (on-premises) Information Disclosure Vulnerability

Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Power-apps

CVE-2026-70003

JDBC Driver for SQL Server Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Jdbc Driver For Sql Server 13.4

CVE-2026-80095

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-88111

SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2022 For X64-based Systems \(cu27\) Sql Server 2025 For X64-based Systems Cu10

CVE-2026-125761

WordPress YITH WooCommerce Ajax Search plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125445

WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125450

WordPress SureRank plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125433

WordPress Futurio Extra plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.25.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125743

WordPress Elementor Addon Elements plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125766

WordPress WPZOOM Social Feed Widget & Block plugin <= 2.4.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125767

WordPress Hubbub Lite plugin <= 1.36.3.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125746

WordPress Back In Stock Notifier for WooCommerce plugin <= 7.5.2 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125850

WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125848

WordPress Leo theme <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—