| CVE-2026-40357 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | high | |
| CVE-2026-40420 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-24285 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25165 | Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25166 | Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally. | high | |
| CVE-2026-25179 | Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-25189 | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-102225 | Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-105009 | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-108461 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-102218 | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69640 | Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network. | medium | |
| CVE-2026-103567 | Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-69976 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-105722 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-108466 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network. | medium | |
| CVE-2026-83932 | Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-102227 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | high | |
| CVE-2026-49785 | Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally. | high | |
| CVE-2026-70112 | Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally. | high | |
| CVE-2026-56170 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-50649 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50524 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-47302 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-62901 | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-68807 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-83827 | Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-83833 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-83795 | Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-83830 | Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-83834 | Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-87694 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-41106 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2026-57993 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | high | |
| CVE-2026-58298 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-42900 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network. | high | |
| CVE-2026-47296 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-49806 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-49802 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50333 | Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-54996 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-58526 | Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-58527 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-58531 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-55145 | Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network. | high | |
| CVE-2026-55020 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-54116 | Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. | medium | |
| CVE-2026-50667 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50672 | Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50348 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network. | high | |
