Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
KEV ✓ EPSS 0.22 CVE-2026-56164 Microsoft US
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55948 Microsoft US
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55899 Microsoft US
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-54988 Microsoft US
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-50678 Microsoft US
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-50675 Microsoft US
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-54108 Microsoft US
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges locally.
EPSS 0.01 CVE-2026-55002 Microsoft US
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-54118 Microsoft US
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-54117 Microsoft US
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55012 Microsoft US
Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55011 Microsoft US
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
EPSS 0.02 CVE-2026-55009 Microsoft US
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-55006 Microsoft US
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-55005 Microsoft US
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-54992 Microsoft US
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-55004 Microsoft US
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-54993 Microsoft US
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49784 Microsoft US
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
EPSS 0.00 CVE-2026-49174 Microsoft US
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49171 Microsoft US
Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49166 Microsoft US
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-49165 Microsoft US
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-42900 Microsoft US
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-47296 Microsoft US
The Patch for this issue was released but the CVE was inadvertently left out of the Patch Tuesday June 2026 release
KEV ✓ EPSS 0.45 CVE-2026-58644 Microsoft US
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50458 Microsoft US
Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50466 Microsoft US
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-48561 Microsoft US
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
EPSS 0.04 CVE-2026-50343 Microsoft US
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-47301 Microsoft US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55129 Microsoft US
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-55050 Microsoft US
Use after free in Microsoft Windows allows an authorized attacker to elevate privileges locally.
EPSS 0.02 CVE-2026-50476 Microsoft US
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.
EPSS 0.01 CVE-2026-50655 Microsoft US
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49162 Microsoft US
Microsoft US
ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-58281 Microsoft US
In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges. The following is a portion of their write-up covering CVE-2026-47291, with a few minimal modifications. A remote code execution…
EPSS 0.23 CVE-2026-47291 Microsoft US 2 zdrojů
Two Microsoft 365 attacks got through Conditional Access policies that seemed fully configured. Learn what went wrong and how Huntress Managed ISPM catches these gaps first.
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-58525 Microsoft US
Written by: Shebin Mathew Introduction The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021, remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem. By obtaining the private key of an ADFS token-signing certificate, an attacker can authenticate as any user to any SAML-federated application, bypassing multifactor authentication (MFA), conditional access, and…
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-58523 Microsoft US
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-58291 Microsoft US
Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58597 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58524 Microsoft US
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-58300 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58298 Microsoft US
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
EPSS 0.00 CVE-2026-58297 Microsoft US
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
EPSS 0.00 CVE-2026-58296 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-58295 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58294 Microsoft US
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58293 Microsoft US
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58292 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58290 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.02 CVE-2026-58289 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58288 Microsoft US
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58286 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58285 Microsoft US