CVE-2026-81390

Microsoft Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Excel 2016 and 9 more

CVE-2026-81389

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Excel 2016 and 8 more

CVE-2026-81387

Microsoft Excel Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Excel 2016 and 8 more

CVE-2026-4765

Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas

Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which is executed within the context of the user’s own session who provides the payload. The demonstrated impact is limited to the user who enters and executes the payload.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Rd Station Conversas

Products

Tallos Chat

CVE-2026-78515

Microsoft Office Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2016 and 6 more

CVE-2026-12611

org.eclipse.jetty.http2/http2-common: org.eclipse.jetty.http2/jetty-http2-common: Jetty: Denial of Service via HTTP/2 race condition

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Jetty

CVE-2026-81952

Microsoft Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2016 and 6 more

CVE-2026-80080

Microsoft Office Word Remote Code Execution Vulnerability

Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-78526

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2016 and 6 more

CVE-2026-78521

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-78507

Microsoft Office Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 5 more

CVE-2026-77906

Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio 2026

CVE-2026-77847

Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tycon Systems

Products

Tpdin-monitor-web3

CVE-2026-72972

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-69465

Microsoft Office SharePoint Remote Code Execution Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-7861

Code Injection in Next4Biz's CSM (Customer Service Management)

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Next4biz

Products

Csm (customer Service Management)

CVE-2026-11814

Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.

CVSS 4.0 · 4.9 Medium EPSS 2.2% KEV · Not listed

Vendors

Netgear

Products

Be9300 Be9300 Firmware Mr60 and 49 more

CVE-2026-11738

Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Be9300 Be9300 Firmware Mr60 and 52 more

CVE-2026-9214

Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

R7000 R7000 Firmware

CVE-2026-11739

Command injection vulnerability in some NETGEAR Nighthawk devices

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

CVSS 4.0 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Netgear

Products

Mr60 Mr60 Firmware Mr70 and 51 more