The internet is broken right now.
34 critical CVEs without a fix in the last 48 hours. The pager is warming up. 47 more already have a fix that someone still has to apply.
-
CVE-2026-88159
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83665
Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
-
CVE-2026-83655
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-83635
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
-
CVE-2026-83516
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-70058
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
CVE-2026-70166
Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.
-
CVE-2026-70119
Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network.
-
CVE-2026-83860
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
-
CVE-2026-83843
Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
-
CVE-2026-83795
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
-
CVE-2026-70031
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
-
CVE-2026-70033
Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
-
CVE-2026-83647
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
-
CVE-2026-88129
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
-
CVE-2026-88130
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
-
CVE-2026-88123
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
-
CVE-2026-88125
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
-
CVE-2026-83649
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
-
CVE-2026-83667
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
CVE-2026-83648
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
CVE-2026-88121
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83521
Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.
-
CVE-2026-96866
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-96861
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-96248
Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.
-
CVE-2026-87716
Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.
-
CVE-2026-85808
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-84017
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-103569
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-100219
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
CVE-2026-100202
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83770
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83693
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
-
CVE-2026-97814
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
-
CVE-2026-70096
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
-
CVE-2026-97817
Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network.
-
CVE-2026-97819
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
CVE-2026-97813
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network.
-
CVE-2026-70025
Use after free in Windows Netlogon allows an authorized attacker to deny service over a network.
-
CVE-2026-108127
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
CVE-2026-108128
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
CVE-2026-108129
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
-
CVE-2026-97830
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
-
CVE-2026-69577
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-70153
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
-
CVE-2026-70147
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83670
Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-83578
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83910
Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.