CVE watch

CVE-2026-83636 published: Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

CVE-2026-83635 published: Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

CVE-2026-83634 published: Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.

CVE-2026-83588 published: Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-83587 published: Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

CVE-2026-83586 published: Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

CVE-2026-83585 published: Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-83584 published: Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.

CVE-2026-83583 published: Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.

CVE-2026-83582 published: Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

CVE-2026-100217 published: Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.

CVE-2026-100216 published: Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-100215 published: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

CVE-2026-100214 published: Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.

CVE-2026-100212 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100211 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100210 published: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100209 published: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100207 published: Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

CVE-2026-100205 published: Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.