cve.bz

Microsoft Patch Tuesday, July 2026: the CVEs, page 2

Filter

Microsoft Patch Tuesday July 2026: the CVEs Microsoft published on 14 July 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 7.8CVE-2026-55949EPSS 0.5%

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  2. 7.8CVE-2026-55947EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  3. 9.8CVE-2026-55944EPSS 1.5%

    Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

  4. 7.1CVE-2026-55898EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  5. 7.1CVE-2026-55145EPSS 0.5%

    Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.

  6. 5.5CVE-2026-55142EPSS 0.6%

    Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  7. 7.8CVE-2026-55141EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  8. 7.8CVE-2026-55140EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  9. 3.3CVE-2026-55139EPSS 0.5%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  10. 5.5CVE-2026-55138EPSS 0.5%

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  11. 7.8CVE-2026-55137EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  12. 7.8CVE-2026-55136EPSS 0.5%

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  13. 5.4CVE-2026-55135EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  14. 7.8CVE-2026-55134EPSS 0.6%

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  15. 7.8CVE-2026-55133EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally.

  16. 7.8CVE-2026-55132EPSS 0.6%

    Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  17. 7.8CVE-2026-55131EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  18. 7.8CVE-2026-55130EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  19. 7.8CVE-2026-55129EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  20. 7.8CVE-2026-55128EPSS 0.6%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  21. 7.8CVE-2026-55127EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  22. 5.4CVE-2026-55126EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  23. 7.8CVE-2026-55125EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  24. 5.5CVE-2026-55124EPSS 0.6%

    Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  25. 7.8CVE-2026-55123EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  26. 7.1CVE-2026-55122EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  27. 5.5CVE-2026-55121EPSS 0.5%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  28. 7.8CVE-2026-55120EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  29. 7.8CVE-2026-55058EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  30. 5.5CVE-2026-55057EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

  31. 7.8CVE-2026-55056EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  32. 7.8CVE-2026-55055EPSS 0.6%

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  33. 6.5CVE-2026-55054EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  34. 7.8CVE-2026-55053EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  35. 8.8CVE-2026-55052EPSS 0.9%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  36. 6.5CVE-2026-55051EPSS 0.9%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  37. 5.5CVE-2026-55050EPSS 0.6%

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  38. 7.8CVE-2026-55049EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  39. 7.8CVE-2026-55048EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  40. 5.5CVE-2026-55047EPSS 0.6%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  41. 5.5CVE-2026-55046EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  42. 8.4CVE-2026-55045EPSS 0.4%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

  43. 7.8CVE-2026-55044EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  44. 7.8CVE-2026-55043EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  45. 5.5CVE-2026-55042EPSS 0.5%

    Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

  46. 7.8CVE-2026-55041EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  47. 9.1CVE-2026-55040KEVExploitEPSS 70%

    Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

  48. 7.8CVE-2026-55039EPSS 0.5%

    Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  49. 7.8CVE-2026-55038EPSS 0.6%

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  50. 7.8CVE-2026-55037EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  51. 7.8CVE-2026-55036EPSS 0.5%

    Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  52. 3.3CVE-2026-55035EPSS 0.6%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  53. 8.7CVE-2026-55034EPSS 0.9%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  54. 7.8CVE-2026-55033EPSS 0.6%

    Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  55. 7.8CVE-2026-55032EPSS 0.6%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  56. 7.8CVE-2026-55031EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  57. 5.4CVE-2026-55030EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  58. 7.8CVE-2026-55029EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  59. 5.5CVE-2026-55028EPSS 0.6%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  60. 5.5CVE-2026-55027EPSS 0.6%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  61. 5.5CVE-2026-55026EPSS 0.4%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

  62. 7.8CVE-2026-55025EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  63. 7.8CVE-2026-55024EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  64. 5.5CVE-2026-55023EPSS 0.6%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  65. 7.8CVE-2026-55022EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

  66. 8.7CVE-2026-55021EPSS 0.9%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  67. 5.4CVE-2026-55020EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  68. 5.4CVE-2026-55019EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  69. 7.8CVE-2026-55018EPSS 0.5%

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  70. 7.8CVE-2026-55017EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  71. 5.4CVE-2026-55016EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  72. 9.8CVE-2026-55010EPSS 1.0%

    Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.

  73. 7.8CVE-2026-54131EPSS 0.5%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  74. 8.4CVE-2026-54128EPSS 0.4%

    Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.

  75. 6.5CVE-2026-54126EPSS 0.9%

    Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

  76. 7.8CVE-2026-54125EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

  77. 7.8CVE-2026-54124EPSS 0.5%

    Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.

  78. 8.8CVE-2026-54121EPSS 1.8%

    Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

  79. 6.5CVE-2026-54116EPSS 1.0%

    Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.

  80. 7.8CVE-2026-54115EPSS 0.3%

    Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally.

  81. 8.8CVE-2026-50692EPSS 0.3%

    Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

  82. 5.5CVE-2026-50690EPSS 0.4%

    Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

  83. 7.8CVE-2026-50689EPSS 0.3%

    Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

  84. 7.8CVE-2026-50688EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  85. 7.8CVE-2026-50687EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  86. 8.1CVE-2026-50686EPSS 0.7%

    Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.

  87. 7.5CVE-2026-50685EPSS 0.7%

    Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.

  88. 4.8CVE-2026-50684EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

  89. 8.0CVE-2026-50683EPSS 0.6%

    Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adjacent network.

  90. 7.1CVE-2026-50682EPSS 0.9%

    Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network.

  91. 5.5CVE-2026-50681EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  92. 7.8CVE-2026-50680EPSS 0.3%

    Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  93. 7.8CVE-2026-50679EPSS 0.5%

    Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  94. 7.8CVE-2026-50677EPSS 0.3%

    Use after free in Windows Media allows an authorized attacker to elevate privileges locally.

  95. 7.0CVE-2026-50676EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.

  96. 7.8CVE-2026-50674EPSS 0.3%

    Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  97. 7.8CVE-2026-50673EPSS 0.2%

    Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

  98. 7.0CVE-2026-50672EPSS 0.2%

    Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.

  99. 7.8CVE-2026-50670EPSS 0.3%

    Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

  100. 7.0CVE-2026-50669EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.