Find the CVE cohort

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:37.655Z. Updated 2026-10-15T15:53:38.038Z.

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-04-14T16:58:36.981Z. Updated 2026-10-15T15:53:37.451Z.

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:36.142Z. Updated 2026-10-15T15:53:37.010Z.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:35.514Z. Updated 2026-10-15T15:53:36.505Z.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:34.827Z. Updated 2026-10-15T15:53:35.869Z.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:34.158Z. Updated 2026-10-15T15:53:35.409Z.

Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:33.606Z. Updated 2026-10-15T15:53:34.875Z.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:32.812Z. Updated 2026-10-15T15:53:34.375Z.

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:32.054Z. Updated 2026-10-15T15:53:33.860Z.

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:31.359Z. Updated 2026-10-15T15:53:33.443Z.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:30.576Z. Updated 2026-10-15T15:53:32.940Z.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:29.994Z. Updated 2026-10-15T15:53:32.452Z.

Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:29.342Z. Updated 2026-10-15T15:53:31.998Z.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:28.635Z. Updated 2026-10-15T15:53:31.461Z.

Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:27.985Z. Updated 2026-10-15T15:53:30.925Z.

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:26.832Z. Updated 2026-10-15T15:53:30.392Z.

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:26.119Z. Updated 2026-10-15T15:53:29.805Z.

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T16:58:25.359Z. Updated 2026-10-15T15:53:29.306Z.