The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119913: Microsoft: Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized…7.0 HighN/AN/ANov 10, 2026
CVE-2026-119912: Microsoft: Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.6.7 MediumN/AN/ANov 10, 2026
CVE-2026-119910: Microsoft: Time-of-check time-of-use (toctou) race condition in Windows Win32K allows an authorized attacker to disclose…4.7 MediumN/AN/ANov 10, 2026
CVE-2026-119909: Microsoft: Uncontrolled resource consumption in Windows Internet Information Services allows an unauthorized attacker to deny…5.9 MediumN/AN/ANov 10, 2026
CVE-2026-119908: Microsoft: Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute…8.8 HighN/AN/ANov 10, 2026
CVE-2026-119907: Microsoft: Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119906: Microsoft Windows Sandbox: Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119905: Microsoft: Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.4.9 MediumN/AN/ANov 10, 2026
CVE-2026-119904: Microsoft: Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119903: Microsoft: Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-119901: Microsoft: Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.6.4 MediumN/AN/ANov 10, 2026
CVE-2026-119900: Microsoft: Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.7.3 HighN/AN/ANov 10, 2026
CVE-2026-119899: Microsoft: Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-119898: Microsoft: Null pointer dereference in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-119895: Microsoft: Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-119894: Microsoft: Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-119893: Microsoft: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service…7.0 HighN/AN/ANov 10, 2026
CVE-2026-119892: Microsoft: Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-119890: Microsoft: Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network.5.3 MediumN/AN/ANov 10, 2026
CVE-2026-119889: Microsoft: Out-of-bounds read in ActiveSyncProvider allows an unauthorized attacker to disclose information over a network.6.5 MediumN/AN/ANov 10, 2026
CVE-2026-119888: Microsoft: Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-119887: Microsoft: Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a…6.5 MediumN/AN/ANov 10, 2026
CVE-2026-119886: Microsoft: Missing authentication for critical function in Windows Telephony Service allows an authorized attacker to elevate…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119885: Microsoft: Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges…6.8 MediumN/AN/ANov 10, 2026
CVE-2026-119884: Microsoft: Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical…6.8 MediumN/AN/ANov 10, 2026
926-950 of 557027