Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
155 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high7.8
CVE-2026-91007

Arbitrary supervisor-mode function pointer injection via charger_set_prop() syscall in the charger driver API

The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

zephyrproject · zephyr
medium4.0
CVE-2026-40274

Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

BlackBerry Ltd · QNX Software Development Platform (SDP) / BlackBerry Ltd · QNX OS for Safety
medium6.5
CVE-2026-119993

Microsoft Office Outlook Information Disclosure Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft 365 Apps for Enterprise / Microsoft · Microsoft Office LTSC 2021
high8.8
CVE-2026-118724

Microsoft Office Excel Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft 365 Apps for Enterprise / Microsoft · Microsoft Office 365 for Mac
high7.8
CVE-2026-118723

Microsoft Office Excel Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft 365 Apps for Enterprise / Microsoft · Microsoft Office 365 for Mac
high8.8
CVE-2026-116934

Microsoft SQL Server Elevation of Privilege Vulnerability

Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft SQL Server 2017 for x64-based Systems (CU31) / Microsoft · Microsoft SQL Server 2019 (GDR)
high8.8
CVE-2026-122475

Windows Storage Spaces Controller Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 version 23H2 / Microsoft · Windows 11 Version 23H2
high8.1
CVE-2026-119945

Windows Modern Device Management (MDM) Remote Code Execution Vulnerability

Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 21H2 / Microsoft · Windows 10 Version 22H2
high7.8
CVE-2026-119941

Volume Shadow Copy Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.8
CVE-2026-119907

Windows Function Discovery Resource Publication Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.0
CVE-2026-119870

Windows SMB Client Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows SMB Client allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.0
CVE-2026-119866

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 21H2 / Microsoft · Windows 10 Version 22H2
medium4.7
CVE-2026-119841

Windows Graphics Kernel Information Disclosure Vulnerability

Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1809 / Microsoft · Windows 10 Version 21H2
high7.0
CVE-2026-119833

Windows Message Queuing Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high8.8
CVE-2026-123382

Microsoft Office Outlook Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft 365 Apps for Enterprise / Microsoft · Microsoft Office LTSC 2021
medium6.5
CVE-2026-110051

Microsoft Office Word Information Disclosure Vulnerability

Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft 365 Apps for Enterprise / Microsoft · Microsoft Office 365 for Mac
medium6.5
CVE-2026-110046

Microsoft Office Word Information Disclosure Vulnerability

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft 365 Apps for Enterprise / Microsoft · Microsoft Office 365 for Mac
high8.8
CVE-2026-112727

Windows Domain Name Service Remote Code Execution Vulnerability

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.8
CVE-2026-118138

Windows Client for NFS Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.5
CVE-2026-105578

Microsoft JScript Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.0
CVE-2026-105565

Windows MIDI Service Module Elevation of Privileges Vulnerability

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 Version 24H2 / Microsoft · Windows 11 Version 25H2
medium6.5
CVE-2026-105559

Windows Active Directory Denial of Service Vulnerability

No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high8.8
CVE-2026-105542

Windows NTFS Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows NTFS allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-105530

Windows System Events Broker Information Disclosure Vulnerability

Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-105527

Windows Encrypting File System (EFS) Denial of Service Vulnerability

Untrusted pointer dereference in Windows Encrypting File System (EFS) allows an authorized attacker to deny service locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high8.8
CVE-2026-114152Package fixes recorded

Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Recorded fixes — Microsoft.NETCore.App.Runtime.win-x86: 8.0.34 or 9.0.23 or 10.0.15 or 11.0.0; Microsoft.NETCore.App.Runtime.win-x64: 8.0.34 or 9.0.23 or 10.0.15 or 11.0.0; 1 more packages. Check your release branch.

Exploitation not established

NuGet / Microsoft.NETCore.App.Runtime.win-x86NuGet / Microsoft.NETCore.App.Runtime.win-x64NuGet / Microsoft.NETCore.App.Runtime.win-arm64
high8.8
CVE-2026-113814

Windows Storage Spaces Controller Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 version 23H2 / Microsoft · Windows 11 Version 23H2
high7.0
CVE-2026-113770

Windows Print Spooler Components Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 21H2 / Microsoft · Windows 10 Version 22H2
high7.0
CVE-2026-113769

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
high7.8
CVE-2026-113767

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809