CVE-2026-94511

SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-102224

Azure CycleCloud Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cyclecloud

CVE-2026-102236

Visual Studio Code Security Feature Bypass Vulnerability

Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-114170

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 12 more

CVE-2026-114169

Windows Raw Image Extension Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Raw Image Extension

CVE-2026-114167

HEVC Video Extensions Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Hevc Video Extensions Hevc Video Extensions For Licensed Appplications Hevc Video Extensions From Device Manufacturer

CVE-2026-114166

Microsoft Raw Image Extension Information Disclosure Vulnerability

Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Raw Image Extension

CVE-2026-114165

HEVC Video Extensions Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Hevc Video Extensions Hevc Video Extensions For Licensed Appplications Hevc Video Extensions From Device Manufacturer

CVE-2026-114164

HEVC Video Extensions Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Hevc Video Extensions Hevc Video Extensions For Licensed Appplications Hevc Video Extensions From Device Manufacturer

CVE-2026-66801

Microsoft Xbox Remote Code Execution Vulnerability

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Microsoft Redhat

Products

Microsoft Gdk Multicluster Globalhub

CVE-2026-109467

Azure DevOps Server Remote Code Execution Vulnerability

Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Devops Azure Devops Server 2025

CVE-2026-109463

Windows DNS Remote Code Execution Vulnerability

Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-108416

Windows File Server Resource Management Service Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-108415

Windows File Server Resource Management Service Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-108403

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-108424

Windows GDI Information Disclosure Vulnerability

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-108417

Windows Remote Desktop Client Information Disclosure Vulnerability

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-108409

Windows Overlay Filter Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-100204

HEIF Image Extensions Remote Code Execution Vulnerability

Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Heif Image Extension

CVE-2026-105590

Windows Active Directory Certificate Services Security Feature Bypass

Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more