Find the CVE cohort

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:49.768Z. Updated 2026-02-13T20:46:16.511Z.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:49.273Z. Updated 2026-02-26T16:57:16.098Z.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:48.693Z. Updated 2026-02-26T16:57:16.560Z.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-11-11T17:59:48.205Z. Updated 2026-02-26T16:57:17.191Z.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:47.547Z. Updated 2026-02-26T16:57:17.674Z.

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:46.977Z. Updated 2026-02-26T16:57:18.212Z.

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:46.405Z. Updated 2026-02-26T16:57:18.713Z.

Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:45.904Z. Updated 2026-02-13T20:46:12.519Z.

Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:45.339Z. Updated 2026-02-13T20:46:11.869Z.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:44.771Z. Updated 2026-02-26T16:57:19.151Z.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:44.205Z. Updated 2026-02-26T16:57:19.778Z.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:43.546Z. Updated 2026-02-26T16:57:20.223Z.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:42.941Z. Updated 2026-02-13T20:46:09.722Z.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:42.387Z. Updated 2026-02-26T16:57:20.920Z.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:41.808Z. Updated 2026-02-26T16:57:21.425Z.

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:41.177Z. Updated 2026-02-26T16:57:21.859Z.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:40.522Z. Updated 2026-02-13T20:46:07.529Z.

Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T17:59:39.877Z. Updated 2026-02-26T16:57:22.384Z.