The internet is broken right now.
94 critical CVEs without a fix in the last 48 hours. Somewhere a staging server is public. It always is. 35 more already have a fix that someone still has to apply.
-
CVE-2026-120790
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-120791
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-120785
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-120786
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-120788
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-120005
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
CVE-2026-120003
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119996
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119997
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
-
CVE-2026-119999
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-120001
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119992
Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119993
Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-119995
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119986
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119971
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
-
CVE-2026-119964
Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119965
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119966
Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119967
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119969
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119970
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
-
CVE-2026-119960
Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119962
Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119963
Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119953
Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119957
Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119958
Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119947
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119948
Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.
-
CVE-2026-119950
Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-119951
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119943
Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119944
Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-119945
Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119937
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges with a physical attack.
-
CVE-2026-119938
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119940
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network.
-
CVE-2026-119932
Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.
-
CVE-2026-119933
Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119934
Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119935
Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
-
CVE-2026-119936
Integer underflow (wrap or wraparound) in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
-
CVE-2026-119921
Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119925
Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119928
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119929
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119916
Heap-based buffer overflow in Windows Input System allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119917
Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.
-
CVE-2026-119918
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.