1047
CVEs
69
Critical
711
High
3
KEV
17
PoC
31
Unpatched C/H
96.1%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
69
HIGH
711
MEDIUM
259
LOW
3
Monthly CVE Trend
Affected Products (30)
Windows Server 2016
4887
Windows Server 2019
4661
Windows Server 2012
3985
Windows Server 2022
3138
Windows Server 2008
3091
Windows 10
2872
Windows 8 1
2102
Windows 7
2087
Windows 10 1809
1995
Windows 10 22h2
1961
Windows 10 21h2
1949
Windows Rt 8 1
1940
Windows 10 1607
1733
Windows Server 2025
1718
Windows 11 23h2
1577
Windows 11 22h2
1511
Windows Server 2022 23h2
1311
Windows 11 24h2
1273
Windows
1234
Windows 10 1507
1102
Internet Explorer
988
Windows 11 21H2
973
Flash Player
760
Office
748
Edge
725
365 Apps
614
Windows 11 25h2
582
Sharepoint Server
502
Windows 11
495
Windows Vista
467
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-69836 | Remote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting maliciously crafted serialized data that the service deserializes without validation (CWE-502). The CVSS 3.1 base score is a maximum 10.0 with a scope change, reflecting unauthenticated network reach and full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the combination of a cloud identity platform and PR:N/UI:N makes this an urgent-patch candidate. | CRITICAL | 10.0 | 1.4% | 126 |
KEV
PoC
|
| CVE-2026-81963 | Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority. | HIGH | 7.8 | 0.6% | 115 |
KEV
PoC
|
| CVE-2026-85880 | Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds. | HIGH | 7.8 | 0.6% | 115 |
KEV
PoC
|
| CVE-2026-71328 | Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.6% | 65 |
PoC
|
| CVE-2026-84452 | Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis. | HIGH | 8.6 | 0.9% | 64 |
PoC
|
| CVE-2026-24301 | Command injection in Microsoft Copilot Web (copilot_web) enables unauthenticated remote attackers to exfiltrate sensitive data over the network by embedding malicious command elements in user-controlled input. The impact is strictly bounded to confidentiality - no integrity or availability loss - and a proof-of-concept is publicly available on GitHub. Despite a CVSS 7.5 score and public PoC, SSVC classifies exploitation as none with Automatable=no, and EPSS sits at 1.63%, suggesting limited real-world exploitation activity at time of analysis. | HIGH | 7.5 | 1.6% | 59 |
PoC
|
| CVE-2026-75418 | Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded. | HIGH | 7.5 | 0.3% | 58 |
PoC
No patch
|
| CVE-2026-54550 | Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2026-54085 | Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-69304 | Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines. | MEDIUM | 5.9 | 0.8% | 55 |
PoC
|
| CVE-2026-69595 | Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS. | CRITICAL | 9.8 | 1.1% | 55 |
|
| CVE-2026-69730 | Remote code execution in the Microsoft Windows DNS Server role (across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free that an unauthenticated attacker can trigger over the network, per CVSS PR:N/UI:N. Microsoft rates it 9.8 (critical) with full confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit has been identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 1.1% | 55 |
|
| CVE-2026-69829 | Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 1.1% | 55 |
|
| CVE-2026-69824 | Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis. | CRITICAL | 9.8 | 1.0% | 55 |
|
| CVE-2026-72979 | Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment. | CRITICAL | 9.8 | 1.0% | 55 |
|