4364
CVEs
371
Critical
2721
High
33
KEV
238
PoC
400
Unpatched C/H
86.5%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
371
HIGH
2721
MEDIUM
1188
LOW
77
Monthly CVE Trend
Affected Products (30)
Windows Server 2016
4923
Windows Server 2019
4698
Windows Server 2012
4017
Windows Server 2022
3176
Windows Server 2008
3091
Windows 10
2872
Windows 8 1
2102
Windows 7
2087
Windows 10 1809
2032
Windows 10 22h2
1998
Windows 10 21h2
1986
Windows Rt 8 1
1940
Windows 10 1607
1769
Windows Server 2025
1759
Windows 11 23h2
1618
Windows 11 22h2
1511
Windows 11 24h2
1314
Windows Server 2022 23h2
1311
Windows
1234
Windows 10 1507
1102
Internet Explorer
988
Windows 11 21H2
973
Flash Player
760
Office
748
Edge
725
Windows 11 25h2
623
365 Apps
614
Sharepoint Server
502
Windows 11
495
Windows 11 26h1
489
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-9242 | WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execution on WatchGuard firewalls. | CRITICAL | 9.3 | 69.0% | 185 |
KEV
PoC
No patch
|
| CVE-2026-50522 | Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated attacker run arbitrary code by sending a crafted serialized payload over the network. The flaw is an untrusted-data deserialization (CWE-502) rated CVSS 9.8 with PR:N/UI:N, meaning no credentials or user interaction are required. No public exploit identified at time of analysis, but the pre-auth network vector and SharePoint's long history as an attacker target make this a high-priority patch. | CRITICAL | 9.8 | 19.7% | 159 |
KEV
PoC
|
| CVE-2026-58644 | Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an unauthenticated network attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). The CVSS 3.1 base score is 9.8 with a fully remote, no-interaction, no-privilege vector (AV:N/AC:L/PR:N/UI:N), placing it among the most severe SharePoint flaws. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but insecure-deserialization RCE in SharePoint has historically been a high-value target for rapid weaponization. | CRITICAL | 9.8 | 1.3% | 150 |
KEV
PoC
|
| CVE-2025-13315 | Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API bypass. The exposed log contains the administrator's username and encrypted password, which can be decrypted using hard-coded keys (CVE-2025-13316) to gain full administrative control. | CRITICAL | 9.3 | 82.4% | 149 |
PoC
No patch
|
| CVE-2026-55040 | Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) lets a network-based, unauthenticated attacker defeat a weak-authentication protection mechanism (CWE-1390) to gain high-impact access to confidentiality and integrity. Rated CVSS 9.1 with no attacker privileges or user interaction required, this is a serious pre-authentication issue in a widely deployed collaboration platform. Microsoft has published a fix, and there is no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.7% | 146 |
KEV
PoC
|
| CVE-2026-56164 | Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an unauthenticated network attacker reach a security-critical function that lacks any authentication check (CWE-306), gaining elevated privileges on the target farm. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects fully remote, unauthenticated exploitation with high confidentiality, integrity, and availability impact. Microsoft has released a patch via MSRC. | CRITICAL | 9.8 | 7.0% | 142 |
KEV
PoC
|
| CVE-2026-50751 | Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. Affected deployments include multiple Quantum R80.40-R82.10 trains and Spark R80.20.X-R82.00.X firmware. | CRITICAL | 9.3 | 0.0% | 137 |
KEV
PoC
No patch
|
| CVE-2025-13316 | Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the credential exposure vulnerability (CVE-2025-13315), this allows attackers to decrypt the admin password from the leaked log file and gain full administrative control of the media server. | HIGH | 8.2 | 72.7% | 134 |
PoC
No patch
|
| CVE-2026-33825 | Privilege escalation in Microsoft Defender Antimalware Platform versions before 4.18.26030.3011 allows authenticated local attackers to gain elevated system privileges through insufficiently granular access controls. CVSS 7.8 (High) reflects local attack vector requiring low privileges. EPSS score of 0.04% (12th percentile) indicates low probability of widespread exploitation. Microsoft has released a patched version (4.18.26030.3011) addressing the access control deficiency. | HIGH | 7.8 | 0.0% | 129 |
KEV
PoC
|
| CVE-2026-69836 | Remote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting maliciously crafted serialized data that the service deserializes without validation (CWE-502). The CVSS 3.1 base score is a maximum 10.0 with a scope change, reflecting unauthenticated network reach and full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the combination of a cloud identity platform and PR:N/UI:N makes this an urgent-patch candidate. | CRITICAL | 10.0 | 1.4% | 126 |
KEV
PoC
|
| CVE-2026-41091 | Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged attacker to elevate to SYSTEM by abusing improper link resolution (CWE-59) before file access. The flaw scores CVSS 7.8 with high impact to confidentiality, integrity, and availability, and no public exploit is identified at time of analysis. Microsoft has released a patch via MSRC, and there is no current CISA KEV listing or EPSS signal indicating active mass exploitation. | HIGH | 7.8 | 12.1% | 126 |
KEV
PoC
|
| CVE-2026-20963 | Microsoft Office SharePoint contains a deserialization vulnerability (CVE-2026-20963) that allows authenticated users to execute arbitrary code over the network through crafted serialized objects. KEV-listed with public PoC, this CVSS 8.8 vulnerability enables any SharePoint user to escalate to server-level code execution, making it a critical threat for organizations relying on SharePoint for document management and collaboration. | CRITICAL | 9.8 | 1.6% | 126 |
KEV
PoC
|
| CVE-2026-45659 | Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) stems from unsafe deserialization of untrusted data (CWE-502), enabling an authorized attacker to run arbitrary code on the server over the network. CVSS 8.8 with low privileges required and no user interaction makes this attractive to post-authentication adversaries, though no public exploit identified at time of analysis and CVSS temporal data marks exploit code maturity as Unproven. | HIGH | 8.8 | 0.5% | 125 |
KEV
PoC
|
| CVE-2025-11953 | React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpoint, allowing unauthenticated network attackers to execute arbitrary code. | CRITICAL | 9.8 | 3.4% | 122 |
KEV
PoC
|
| CVE-2026-42897 | Cross-site scripting (XSS) in Microsoft Exchange Server enables remote attackers to spoof content and steal credentials without authentication. Affects Exchange Server 2016 CU23, 2019 CU14/CU15, and Subscription Edition. Functional exploit code exists (CVSS temporal E:F) though no active exploitation confirmed at analysis time. CVSS 8.1 (High) driven by network vector, no authentication requirement, and dual confidentiality/integrity impact. Microsoft released patches via MSRC security update guide. Medium-high priority for organizations running affected Exchange versions with webmail or OWA exposed. | MEDIUM | 6.1 | 0.2% | 121 |
KEV
PoC
|