cve.bz

New CVEs this week, the last 7 days, newest first, page 61

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. 6.3CVE-2026-115559EPSS 0.3%

    IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake,…

  2. 8.8CVE-2026-114171EPSS 0.8%

    User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  3. 7.8CVE-2026-114170EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  4. 8.8CVE-2026-114169EPSS 1.0%

    Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

  5. 7.8CVE-2026-114167EPSS 0.4%

    Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

  6. 5.5CVE-2026-114166EPSS 0.6%

    Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.

  7. 7.8CVE-2026-114165EPSS 0.5%

    Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

  8. 8.8CVE-2026-114164EPSS 0.9%

    Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

  9. 9.1CVE-2026-114162EPSS 0.9%

    Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

  10. 7.8CVE-2026-114161EPSS 0.4%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.

  11. 9.8CVE-2026-114160EPSS 0.9%

    Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

  12. 8.8CVE-2026-114159EPSS 0.9%

    Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  13. 8.8CVE-2026-114158EPSS 0.9%

    Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  14. 7.5CVE-2026-114157EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

  15. 6.5CVE-2026-114156EPSS 0.6%

    Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

  16. 7.5CVE-2026-114155EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

  17. 7.5CVE-2026-114154EPSS 1.3%

    Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  18. 8.8CVE-2026-114152EPSS 0.9%

    Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  19. 8.8CVE-2026-114151EPSS 1.5%

    Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.

  20. 5.9CVE-2026-114150EPSS 0.8%

    Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

  21. 7.5CVE-2026-114149EPSS 1.3%

    Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  22. 7.5CVE-2026-114147EPSS 1.3%

    Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  23. 9.0CVE-2026-114146EPSS 0.8%

    Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

  24. 7.8CVE-2026-113865EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  25. 6.4CVE-2026-113864EPSS 0.3%

    Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  26. 8.8CVE-2026-113863EPSS 0.6%

    Heap-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to elevate privileges over an adjacent network.

  27. 8.1CVE-2026-113862EPSS 0.9%

    Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network.

  28. 7.5CVE-2026-113861EPSS 0.3%

    Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  29. 7.0CVE-2026-113860EPSS 0.3%

    Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  30. 7.5CVE-2026-113859EPSS 0.4%

    Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.

  31. 7.8CVE-2026-113856EPSS 0.3%

    Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  32. 7.5CVE-2026-113855EPSS 0.4%

    Use of uninitialized resource in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.

  33. 7.8CVE-2026-113848EPSS 0.5%

    Null pointer dereference in Windows NTFS allows an unauthorized attacker to execute code locally.

  34. 7.8CVE-2026-113847EPSS 0.3%

    Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.

  35. 5.5CVE-2026-113844EPSS 0.4%

    Improper access control in Windows NTFS allows an authorized attacker to perform tampering locally.

  36. 7.8CVE-2026-113843EPSS 0.3%

    Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

  37. 7.0CVE-2026-113842EPSS 0.3%

    Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.

  38. 7.5CVE-2026-113825EPSS 0.6%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allows an authorized attacker to execute code over a network.

  39. 7.5CVE-2026-113823EPSS 1.3%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.

  40. 6.5CVE-2026-113822EPSS 0.9%

    Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

  41. 4.1CVE-2026-113821EPSS 0.3%

    Buffer over-read in Microsoft Windows SCSI Class System File allows an authorized attacker to disclose information locally.

  42. 7.0CVE-2026-113820EPSS 0.3%

    Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

  43. 7.0CVE-2026-113819EPSS 0.3%

    Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

  44. 6.5CVE-2026-113818EPSS 1.1%

    Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network.

  45. 6.6CVE-2026-113817EPSS 0.5%

    Heap-based buffer overflow in Windows Devices Human Interface allows an authorized attacker to elevate privileges with a physical attack.

  46. 4.1CVE-2026-113816EPSS 0.3%

    Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

  47. 4.7CVE-2026-113815EPSS 1.9%

    Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

  48. 8.8CVE-2026-113814EPSS 0.8%

    Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

  49. 5.3CVE-2026-113773EPSS 0.6%

    Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network.

  50. 4.7CVE-2026-113772EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Redirected Drive Buffering allows an authorized attacker to disclose information locally.