The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119937: Microsoft: Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges with a…6.6 MediumN/AN/ANov 10, 2026
CVE-2026-119936: Microsoft: Integer underflow (wrap or wraparound) in Windows Internet Information Services allows an unauthorized attacker to deny…5.9 MediumN/AN/ANov 10, 2026
CVE-2026-119935: Microsoft: Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to elevate privileges with a…6.8 MediumN/AN/ANov 10, 2026
CVE-2026-119934: Microsoft: Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/ANov 10, 2026
CVE-2026-119933: Microsoft: Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-119932: Microsoft: Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.7.5 HighN/AN/ANov 10, 2026
CVE-2026-119931: Microsoft: Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to…7.0 HighN/AN/ANov 10, 2026
CVE-2026-119929: Microsoft: Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-119928: Microsoft: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-119925: Microsoft: Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.8.8 HighN/AN/ANov 10, 2026
CVE-2026-119921: Microsoft: Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate…7.0 HighN/AN/ANov 10, 2026
CVE-2026-119919: Microsoft: Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate…7.0 HighN/AN/ANov 10, 2026
CVE-2026-119918: Microsoft: Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.6.8 MediumN/AN/ANov 10, 2026
CVE-2026-119917: Microsoft: Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119916: Microsoft: Heap-based buffer overflow in Windows Input System allows an authorized attacker to elevate privileges locally.8.8 HighN/AN/ANov 10, 2026
CVE-2026-119914: Microsoft: Improper restriction of communication channel to intended endpoints in Windows Setup and Deployment allows an…6.7 MediumN/AN/ANov 10, 2026
CVE-2026-119913: Microsoft: Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized…7.0 HighN/AN/ANov 10, 2026
CVE-2026-119912: Microsoft: Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.6.7 MediumN/AN/ANov 10, 2026
CVE-2026-119910: Microsoft: Time-of-check time-of-use (toctou) race condition in Windows Win32K allows an authorized attacker to disclose…4.7 MediumN/AN/ANov 10, 2026
CVE-2026-119909: Microsoft: Uncontrolled resource consumption in Windows Internet Information Services allows an unauthorized attacker to deny…5.9 MediumN/AN/ANov 10, 2026
CVE-2026-119908: Microsoft: Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute…8.8 HighN/AN/ANov 10, 2026
CVE-2026-119906: Microsoft Windows Sandbox: Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119907: Microsoft: Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119904: Microsoft: Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to…7.8 HighN/AN/ANov 10, 2026
CVE-2026-119899: Microsoft: Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
951-975 of 557027