| CVE-2026-20865 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-20869 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-20877 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-20925 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-55055 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-55029 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-62914 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-59136 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-62723 | Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-61938 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-68785 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | medium | |
| CVE-2026-69645 | Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69717 | Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69822 | Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-77886 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-83948 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-69300 | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-68833 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. | medium | |
| CVE-2026-69786 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-85887 | Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network. | high | |
| CVE-2026-69843 | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-25255 | Exposed dangerous function lead to privilege escalation via gRPC server. | high | |
| CVE-2026-25167 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. | high | |
| CVE-2026-55129 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-55038 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-55124 | Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-70314 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-59132 | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-62819 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | high | |
| CVE-2026-61349 | Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62710 | Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62822 | Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-67376 | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-68876 | Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69290 | Stack-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69455 | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-72936 | Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-77491 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-80079 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | medium | |
| CVE-2026-83941 | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-70203 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-69510 | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-62810 | Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69365 | Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69493 | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. | critical | |
| CVE-2026-69738 | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-21530 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. | medium | |
| CVE-2026-33842 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-42982 | Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-41087 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | medium | |
