Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
148,528 matching · page 54/2971Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-87700(opens NVD record) | High | 7.8 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-87699(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-87698(opens NVD record) | Medium | 5.5 | Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-87697(opens NVD record) | High | 8.8 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-87696(opens NVD record) | High | 7.5 | Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | Oct 13, 2026 |
| CVE-2026-87695(opens NVD record) | High | 7.8 | Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-87694(opens NVD record) | High | 7.8 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-87693(opens NVD record) | High | 7.0 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-87692(opens NVD record) | High | 7.8 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-87691(opens NVD record) | High | 7.8 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-86063(opens NVD record) | Unscored | — | Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179. | Oct 13, 2026 |
| CVE-2026-85945(opens NVD record) | High | 7.8 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85943(opens NVD record) | High | 7.0 | Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85941(opens NVD record) | High | 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85939(opens NVD record) | Medium | 5.3 | Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. | Oct 13, 2026 |
| CVE-2026-85938(opens NVD record) | Medium | 5.5 | Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-85936(opens NVD record) | High | 8.8 | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-85935(opens NVD record) | Medium | 5.5 | Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-85934(opens NVD record) | High | 7.0 | Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85933(opens NVD record) | High | 7.8 | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85932(opens NVD record) | Medium | 6.5 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Oct 13, 2026 |
| CVE-2026-85931(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-85930(opens NVD record) | High | 7.0 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85928(opens NVD record) | Critical | 9.8 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-85927(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85926(opens NVD record) | High | 8.1 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-85925(opens NVD record) | High | 8.2 | Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network. | Oct 13, 2026 |
| CVE-2026-85922(opens NVD record) | High | 7.4 | Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. | Oct 13, 2026 |
| CVE-2026-85920(opens NVD record) | High | 7.0 | Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85918(opens NVD record) | High | 7.0 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85916(opens NVD record) | Medium | 6.2 | Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-85915(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85914(opens NVD record) | High | 7.0 | Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85912(opens NVD record) | High | 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85911(opens NVD record) | High | 7.8 | Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85910(opens NVD record) | Medium | 5.5 | Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-85909(opens NVD record) | Medium | 5.5 | Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-85908(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85906(opens NVD record) | High | 7.8 | Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85905(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85904(opens NVD record) | High | 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85903(opens NVD record) | High | 8.8 | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-85902(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85901(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85900(opens NVD record) | High | 8.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-85891(opens NVD record) | High | 7.5 | Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network. | Oct 13, 2026 |
| CVE-2026-85884(opens NVD record) | High | 7.8 | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85881(opens NVD record) | High | 8.0 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. | Oct 13, 2026 |
| CVE-2026-85879(opens NVD record) | High | 7.0 | Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-85874(opens NVD record) | High | 7.8 | Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally. | Oct 13, 2026 |