The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-88218: Microsoft: Double free in Windows DNS allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-88217: Microsoft: Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.5.5 MediumN/AN/ANov 10, 2026
CVE-2026-88216: Microsoft: Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code…7.5 HighN/AN/ANov 10, 2026
CVE-2026-88215: Microsoft: Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.6.4 MediumN/AN/ANov 10, 2026
CVE-2026-88213: Microsoft: Numeric truncation error in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-88212: Microsoft: Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an…7.5 HighN/AN/ANov 10, 2026
CVE-2026-88211: Microsoft: Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network.5.7 MediumN/AN/ANov 10, 2026
CVE-2026-88187: Microsoft: Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an…8.0 HighN/AN/ANov 10, 2026
CVE-2026-88176: Microsoft Microsoft SharePoint Server Subscription Edition: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.8.8 HighN/AN/ANov 10, 2026
CVE-2026-88111: Microsoft: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.7.5 HighN/AN/ANov 10, 2026
CVE-2026-85942: Microsoft: Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges…7.8 HighN/AN/ANov 10, 2026
CVE-2026-85929: Microsoft: Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to…7.8 HighN/AN/ANov 10, 2026
CVE-2026-85923: Microsoft Azure DevOps Server: Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate…8.8 HighN/AN/ANov 10, 2026
CVE-2026-85907: Microsoft: Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally.4.4 MediumN/AN/ANov 10, 2026
CVE-2026-85862: Microsoft: Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-85844: Microsoft: Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate…9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-85839: Microsoft: Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code…8.8 HighN/AN/ANov 10, 2026
CVE-2026-85838: Microsoft: Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code…8.8 HighN/AN/ANov 10, 2026
CVE-2026-85801: Microsoft: Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate…7.8 HighN/AN/ANov 10, 2026
CVE-2026-84010: Microsoft: Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network.7.5 HighN/AN/ANov 10, 2026
CVE-2026-84005: Microsoft: Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-84004: Microsoft: Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-83953: Microsoft GitHub Copilot Plugin for JetBrains IDEs: Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-83894: Microsoft: Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-83684: Microsoft: Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.7.5 HighN/AN/ANov 10, 2026
676-700 of 557027