Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

2931 advisories match Clear all Export 25 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	10.0	CVE-2026-97785	Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. MicrosoftMicrosoft AAD App Proxy, Microsoft Entra application proxy	NVD	Oct 22 22:20 UTC
CVE-2026-97785Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. Executive summary The advisory describes an authentication flaw in AAD App Proxy that could let an unauthorized attacker gain higher privileges over a network. The advisory does not state how severe the flaw is rated or what fix the vendor recommends. Technical summary The flaw is an improper authentication weakness (CWE class not stated) in AAD App Proxy that allows an unauthorized attacker to elevate privileges over a network. The advisory does not state the affected versions, fixed versions, or any workaround. No CVSS score, exploitation status, or detection guidance is stated. The advisory text is repeated twice with no additional detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Affects Microsoft Microsoft AAD App Proxy Microsoft Entra application proxy NIST National Vulnerability DatabasePublished Oct 22, 2026 22:20 UTC Read the advisory
	High	7.5	CVE-2026-96185	Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. MicrosoftMicrosoft Exchange Online	NVD	Oct 22 22:19 UTC
CVE-2026-96185Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. Executive summary A stack-based buffer overflow in Microsoft Exchange Online lets an authorized attacker run code over a network. The advisory does not state how severe the issue is or what the vendor recommends. Technical summary The flaw is a stack-based buffer overflow, which can let an attacker execute code. The attacker must be authorized and can reach the service over a network. Affected and fixed versions are not stated, as Exchange Online is a cloud service. No workarounds, detection guidance, CVSS score, or information about exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Exchange Online NIST National Vulnerability DatabasePublished Oct 22, 2026 22:19 UTC Read the advisory
	Critical	10.0	CVE-2026-83938	Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. MicrosoftMicrosoft Azure Kubernetes Configuration Service	NVD	Oct 22 22:19 UTC
CVE-2026-83938Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. Executive summary A flaw in Microsoft's Azure Kubernetes Configuration Service lets an unauthorized attacker on the network raise their privileges. The advisory does not state how severe the issue is or whether a fix is available, and it gives no recommended action. Technical summary The weakness is missing authentication for a critical function, which allows an unauthenticated attacker to elevate privileges over a network. The advisory does not state affected versions, fixed versions, a CVSS score, or any workaround. No detection guidance is given, and it is not stated whether the flaw is exploited in the wild. The advisory gives no details on preconditions beyond network reachability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affects Microsoft Microsoft Azure Kubernetes Configuration Service NIST National Vulnerability DatabasePublished Oct 22, 2026 22:19 UTC Read the advisory
	Critical	10.0	CVE-2026-110063	Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. MicrosoftMicrosoft VM Inspector for Azure Virtual Machines	NVD	Oct 22 22:18 UTC
CVE-2026-110063Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. From the advisory Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affects Microsoft Microsoft VM Inspector for Azure Virtual Machines NIST National Vulnerability DatabasePublished Oct 22, 2026 22:18 UTC Read the advisory
	High	7.7	CVE-2026-108456	Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. MicrosoftMicrosoft Azure AI Foundry	NVD	Oct 22 22:17 UTC
CVE-2026-108456Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. Executive summary A server-side request forgery flaw in Microsoft Azure AI Foundry lets an authorized attacker over a network elevate privileges. The advisory does not state a severity rating or a score. Technical summary The flaw is classified as server-side request forgery (SSRF), which lets a request made by the server reach destinations the attacker chooses. The advisory says an authorized attacker can exploit it over a network to elevate privileges. Affected versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affects Microsoft Microsoft Azure AI Foundry NIST National Vulnerability DatabasePublished Oct 22, 2026 22:17 UTC Read the advisory
	Critical	9.1	CVE-2026-105014	Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft Azure Pipelines	NVD	Oct 22 22:17 UTC
CVE-2026-105014Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. From the advisory Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Microsoft Microsoft Azure Pipelines NIST National Vulnerability DatabasePublished Oct 22, 2026 22:17 UTC Read the advisory
	Medium	5.3	CVE-2026-80092	Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. MicrosoftMicrosoft Identity Web	NVD	Oct 16 18:18 UTC
CVE-2026-80092Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. From the advisory Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Identity Web NIST National Vulnerability DatabasePublished Oct 16, 2026 18:18 UTC Read the advisory
	Medium	5.9	CVE-2026-109461	Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. MicrosoftMicrosoft Identity Client for NodeJS	NVD	Oct 16 18:17 UTC
CVE-2026-109461Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. From the advisory Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Identity Client for NodeJS NIST National Vulnerability DatabasePublished Oct 16, 2026 18:17 UTC Read the advisory
	High	7.5	CVE-2026-109468	Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. MicrosoftMicrosoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, Microsoft System.Formats.Cbor	NVD	Oct 15 21:17 UTC
CVE-2026-109468Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. From the advisory Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft System.Formats.Cbor NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	Medium	6.5	CVE-2026-108455	Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108455Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. From the advisory Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	Medium	6.5	CVE-2026-108454	Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108454Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. From the advisory Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	Medium	6.5	CVE-2026-108453	Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108453Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. From the advisory Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108452	Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. MicrosoftMicrosoft SharePoint Server Subscription Edition, Microsoft Sharepoint Server	NVD	Oct 15 21:17 UTC
CVE-2026-108452Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. From the advisory Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft SharePoint Server Subscription Edition Microsoft Sharepoint Server NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108451	Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024	NVD	Oct 15 21:17 UTC
CVE-2026-108451Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108450	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024	NVD	Oct 15 21:17 UTC
CVE-2026-108450Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108449	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108449Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-108448	Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108448Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. From the advisory Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108447	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024	NVD	Oct 15 21:17 UTC
CVE-2026-108447Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108446	Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365, Microsoft Office Online Server	NVD	Oct 15 21:17 UTC
CVE-2026-108446Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. From the advisory Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 Microsoft Office Online Server NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108445	Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108445Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108444	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108444Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. From the advisory Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108443	Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108443Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108442	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108442Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108441	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108441Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-108440	Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. MicrosoftMicrosoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365	NVD	Oct 15 21:17 UTC
CVE-2026-108440Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. From the advisory Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft 365 Apps Microsoft Office 2021 Microsoft Office 2024 Microsoft Office 365 for Mac Microsoft Office LTSC for Mac 2021 Microsoft Office LTSC for Mac 2024 Microsoft 365 NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited