Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.0	CVE-2026-97810	Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows 11 26H2	NVD	Oct 13 19:22 UTC
CVE-2026-97810Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. From the advisory Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows Server 2022 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	High	7.8	CVE-2026-97803	Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 26H1, Microsoft Windows 11 26H1	NVD	Oct 13 19:22 UTC
CVE-2026-97803Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. From the advisory Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 26H1 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	High	7.8	CVE-2026-97800	Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:22 UTC
CVE-2026-97800Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. From the advisory Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	High	7.8	CVE-2026-97799	Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:22 UTC
CVE-2026-97799Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. From the advisory Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	Medium	5.5	CVE-2026-97790	Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering... MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows 11 26H2	NVD	Oct 13 19:22 UTC
CVE-2026-97790Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering... From the advisory Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows Server 2022 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	Medium	5.5	CVE-2026-96944	Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows 11 26H2	NVD	Oct 13 19:22 UTC
CVE-2026-96944Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally. From the advisory Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows Server 2022 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	High	7.0	CVE-2026-96939	Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1	NVD	Oct 13 19:22 UTC
CVE-2026-96939Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. From the advisory Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	Medium	5.5	CVE-2026-96849	Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. MicrosoftMicrosoft Windows 11 version 26H1, Microsoft Windows 11 26H1	NVD	Oct 13 19:21 UTC
CVE-2026-96849Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. From the advisory Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Windows 11 version 26H1 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-96249	Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-96249Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-96223	Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-96223Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.0	CVE-2026-96215	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-96215Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. From the advisory Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	Medium	5.5	CVE-2026-96183	Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-96183Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. From the advisory Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-88100	Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-88100Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.0	CVE-2026-88079	Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-88079Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. From the advisory Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-88074	Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-88074Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. From the advisory Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	Medium	5.5	CVE-2026-85916	Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1	NVD	Oct 13 19:21 UTC
CVE-2026-85916Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. From the advisory Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-85837	Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-85837Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. From the advisory Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-85836	Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-85836Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.0	CVE-2026-85823	Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows 11 26H2	NVD	Oct 13 19:21 UTC
CVE-2026-85823Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows Server 2022 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-85804	Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1	NVD	Oct 13 19:21 UTC
CVE-2026-85804Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.0	CVE-2026-85803	Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1	NVD	Oct 13 19:21 UTC
CVE-2026-85803Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.0	CVE-2026-83900	Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1	NVD	Oct 13 19:20 UTC
CVE-2026-83900Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:20 UTC Read the advisory
	High	7.0	CVE-2026-83886	Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1	NVD	Oct 13 19:20 UTC
CVE-2026-83886Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. From the advisory Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 23H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:20 UTC Read the advisory
	Medium	5.6	CVE-2026-83885	Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation), Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows 11 26H2	NVD	Oct 13 19:20 UTC
CVE-2026-83885Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally. From the advisory Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows Server 2025 Microsoft Windows Server 2025 (Server Core installation)Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows Server 2022 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:20 UTC Read the advisory
	Medium	5.5	CVE-2026-83870	Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally. MicrosoftMicrosoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H1, Microsoft Windows 11 26H2	NVD	Oct 13 19:20 UTC
CVE-2026-83870Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally. From the advisory Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Microsoft Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 11 24H2 Microsoft Windows 11 25H2 Microsoft Windows 11 26H1 Microsoft Windows 11 26H2 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:20 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited