CVE-2026-116928

Windows Search Remote Code Execution Vulnerability

Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-116714

Windows AppX Deployment Service Elevation of Privilege Vulnerability

Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 4 more

CVE-2026-113815

Microsoft PowerShell Security Feature Bypass Vulnerability

Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 4.7 Medium EPSS 1.9% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-113816

Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-108408

Windows Telephony Service Information Disclosure Vulnerability

Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105518

Windows iSCSI Remote Code Execution Vulnerability

Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-116700

Windows Telephony Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-113821

Microsoft Windows SCSI Class System File Information Disclosure Vulnerability

Buffer over-read in Microsoft Windows SCSI Class System File allows an authorized attacker to disclose information locally.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-113856

Windows Hyper-V Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 14 more

CVE-2026-113862

Windows Network Address Translation (NAT) Remote Code Execution Vulnerability

Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-113863

Windows DHCP Client Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to elevate privileges over an adjacent network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 5 more

CVE-2026-113864

Windows Hyper-V Elevation of Privilege Vulnerability

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119385

Windows Hyper-V Denial of Service Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to deny service locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-112975

Windows Link-Layer Discovery Protocol (LLDP) Denial of Service Vulnerability

Untrusted pointer dereference in Windows Link-Layer Discovery Protocol (LLDP) allows an unauthorized attacker to deny service over an adjacent network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-112976

Windows Print Spooler Components Elevation of Privilege Vulnerability

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-112979

Windows State Repository Service Tampering Vulnerability

Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-112981

Windows Print Spooler Components Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-112982

Microsoft Account Tampering Vulnerability

Missing authentication for critical function in Microsoft Account allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-112985

Windows JScript Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-112986

Windows DWM Core Library Elevation of Privilege Vulnerability

No cwe for this issue in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 15 more