The internet is broken right now.
71 critical CVEs without a fix in the last 48 hours. Developers are crying quietly into their IDEs. 15 more already have a fix that someone still has to apply.
-
CVE-2026-113815
Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature locally.
-
CVE-2026-119904
Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
-
CVE-2026-114151
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119932
Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.
-
CVE-2026-105512
Integer underflow (wrap or wraparound) in Microsoft QUIC allows an unauthorized attacker to deny service over a network.
-
CVE-2026-114154
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
CVE-2026-119958
Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96017
Use after free in DNS Server allows an authorized attacker to deny service over a network.
-
CVE-2026-96176
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
-
CVE-2026-96077
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
-
CVE-2026-88236
Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.
-
CVE-2026-112966
Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network.
-
CVE-2026-105515
Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network.
-
CVE-2026-116928
Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
-
CVE-2026-112967
Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
-
CVE-2026-116926
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
-
CVE-2026-119940
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network.
-
CVE-2026-112807
Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to deny service over a network.
-
CVE-2026-112795
Untrusted pointer dereference in Windows Security Account Manager allows an authorized attacker to deny service over a network.
-
CVE-2026-105568
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
CVE-2026-113818
Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network.
-
CVE-2026-88218
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119905
Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.
-
CVE-2026-109463
Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96986
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
-
CVE-2026-96134
Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
-
CVE-2026-105561
Uncontrolled resource consumption in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-70240
Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.
-
CVE-2026-113363
Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running.
-
CVE-2026-85844
Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-108401
Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
-
CVE-2026-105559
No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network.
-
CVE-2026-96082
Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.
-
CVE-2026-88243
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
CVE-2026-108417
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108418
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108419
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-108424
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-96988
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
-
CVE-2026-96970
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
-
CVE-2026-118146
Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.
-
CVE-2026-96078
Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
-
CVE-2026-95901
Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
-
CVE-2026-119969
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
-
CVE-2026-112808
Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.
-
CVE-2026-116697
Null pointer dereference in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to deny service over a network.
-
CVE-2026-114169
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96972
Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-105579
Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-119970
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.