Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-42833

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Dynamics 365
CVE-2026-40420

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 3 more
CVE-2026-35436

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 3 more
CVE-2026-40418

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 3 more
CVE-2026-9982

chromium-browser: Insufficient validation of untrusted input in ANGLE

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-40367

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 10 more
CVE-2026-40362

Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 8 more
CVE-2026-40358

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2016 and 6 more
CVE-2026-35429

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge
CVE-2026-9977

chromium-browser: Insufficient validation of untrusted input in WebShare

Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-41088

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 16 more
CVE-2026-40421

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 5 more
CVE-2026-40399

Windows TCP/IP Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 22 more