CVE-2026-111300

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-116942

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 4 more

CVE-2026-116943

Microsoft SQL Server Information Disclosure Vulnerability

Buffer over-read in SQL Server allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116947

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-105569

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more

CVE-2026-105578

Microsoft JScript Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-110053

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-110054

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-110064

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Apps For Enterprise Microsoft Office 365 For Mac and 9 more

CVE-2026-28806

Improper authorization in device bulk actions and device update API allows cross-organization device control

Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level. An attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity. In environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices. This issue affects nerves_hub: from 1.0.0 before 2.4.0.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Nerves-hub

Products

Nerves Hub Web Nerveshub

CVE-2026-114149

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 13 more

CVE-2026-114154

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Windows .net 8.0 Installed On Windows .net 9.0 Installed On Windows and 4 more

CVE-2026-114157

ASP.NET Core Security Feature Bypass Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Windows .net 11.0 Installed On Windows .net 8.0 Installed On Windows and 4 more

CVE-2026-114159

Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Windows .net 11.0 Installed On Windows .net 8.0 Installed On Windows and 3 more

CVE-2026-110043

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 2 more

CVE-2026-111286

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-111287

Microsoft Office Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-111290

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 2 more

CVE-2026-111294

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-111296

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server