The internet is broken right now.
96 critical CVEs without a fix in the last 48 hours. Somewhere a staging server is public. It always is. 34 more already have a fix that someone still has to apply.
-
CVE-2026-110054
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-110047
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-110048
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-110049
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
CVE-2026-109505
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-110043
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109500
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109501
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109503
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109493
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109494
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109496
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109498
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109499
Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
CVE-2026-109487
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109491
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-109475
Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.
-
CVE-2026-109473
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
CVE-2026-109459
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
-
CVE-2026-108419
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108424
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108421
Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-108423
Out-of-bounds read in Windows WinHTTP allows an authorized attacker to disclose information locally.
-
CVE-2026-108425
Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108414
Use after free in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108417
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108418
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108411
Heap-based buffer overflow in Windows ODBC Driver allows an unauthorized attacker to execute code over a network.
-
CVE-2026-108412
Heap-based buffer overflow in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108413
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108408
Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.
-
CVE-2026-108410
Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
-
CVE-2026-108405
Integer overflow or wraparound in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108406
Use after free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108407
Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108404
Heap-based buffer overflow in Windows CD-ROM Driver allows an unauthorized attacker to execute code with a physical attack.
-
CVE-2026-108403
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105589
Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.
-
CVE-2026-108401
Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
-
CVE-2026-105586
Null pointer dereference in Microsoft Windows SCSI Class System File allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105587
Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105575
Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105578
Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
-
CVE-2026-105579
Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-105580
Heap-based buffer overflow in Windows Management Instrumentation allows an unauthorized attacker to execute code locally.
-
CVE-2026-105581
Stack-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105565
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105567
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
CVE-2026-105568
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
CVE-2026-105569
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.