110/111 sources · synced 00:46 UTC Customize Public mode

Security

CVE detail from Microsoft's public MSRC CVRF API, cross-checked with CISA's Known Exploited Vulnerabilities catalog. Counts cover Microsoft-issued CVEs; republished third-party CVEs such as Chromium or Linux are hidden unless you include them.

Security Update Guide CISA KEV

CVEs · all collected releases

9 matches · most urgent first CSV Text
CVE Vulnerability Severity CVSSEPSSImpact StatusFixed by
CVE-2026-58644 Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint Critical 9.816%Remote Code Execution ExploitedCISA KEV · due 19 JulExploit code publicRevised 15 Jul
KB5002873KB5002874+1
CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass VulnerabilityMicrosoft Office SharePoint Critical 9.118%Security Feature Bypass CISA KEV · due 21 AugExploit code public
KB5002882KB5002883+1
CVE-2026-41091 Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Defender Important 7.80.4%Elevation of Privilege ExploitedCISA KEV · due 3 JunDisclosedRevised 26 May
—
CVE-2026-45498 Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender Low 4.01.3%Denial of Service ExploitedCISA KEV · due 3 JunDisclosedRevised 26 May
—
CVE-2026-50522 Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint Critical 9.83.0%Remote Code Execution CISA KEV · due 25 Jul
KB5002882KB5002883+1
CVE-2026-42897 Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server Critical 8.10.5%Spoofing ExploitedCISA KEV · due 29 MayRevised 14 Jul
KB5094139KB5094140+2
CVE-2026-45659 Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint Important 8.82.7%Remote Code Execution CISA KEV · due 4 JulRevised 26 May
KB5002863KB5002868+1
CVE-2026-56155 Active Directory Federation Services Elevation of Privilege VulnerabilityActive Directory Federation Services (AD FS) Important 7.80.3%Elevation of Privilege ExploitedCISA KEV · due 28 Jul
KB5099444KB5099445+4
CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft Office SharePoint Moderate 5.31.0%Elevation of Privilege ExploitedCISA KEV · due 17 Jul
KB5002882KB5002883+1

CISA KEV · Microsoft additions

All 389
CVE-2026-65660 SharePoint
Microsoft SharePoint Code Injection Vulnerability
Added 25 Sep 2026Federal due date 28 Sep
CVE-2026-85880 Windows
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Added 8 Sep 2026Federal due date 22 Sep
CVE-2026-81963 Windows
Microsoft Windows Link Following Vulnerability
Added 8 Sep 2026Federal due date 22 Sep
CVE-2019-1068 SQL Server
Microsoft SQL Server Remote Code Execution Vulnerability
Added 26 Aug 2026Federal due date 29 Aug

Security news

All
Yesterday4 items
Security baseline
LGPO.zip
Security baseline1.0Security Microsoft Security Compliance Toolkit artifacts

Exploited in other vendors' products

CISA KEV · Apple, Android, Chrome, Firefox, VMware, Oracle, Jamf · last 90 days
CVE-2026-86950 Apple · Multiple Products
Apple Multiple Products Out-of-Bounds Write Vulnerability
Added 29 Sep 2026iOS and iPadOSmacOS
CVE-2026-58704 Google · Pixel
Google Pixel Improper Authorization Vulnerability
Added 16 Sep 2026Android
CVE-2026-87491 Google · Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability
Added 9 Sep 2026Google Chrome
CVE-2026-85046 Google · Chromium V8
Google Chromium V8 Type Confusion Vulnerability
Added 4 Sep 2026Google Chrome
CVE-2026-21962 Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Added 24 Aug 2026Oracle WebLogic Server
CVE-2026-65400 Apple · macOS
Apple macOS Improper Authentication Vulnerability
Added 18 Aug 2026macOS
CVE-2026-59310 Broadcom · VMware vCenterRansomware
Broadcom VMware vCenter Path Traversal Vulnerability
Added 18 Aug 2026VMware vCenter Server
CVE-2026-46817 Oracle · E-Business Suite
Oracle E-Business Suite Improper Privilege Management Vulnerability
Added 15 Jul 2026Oracle E-Business Suite

Security baselines

Microsoft Security Compliance Toolkit downloads, as the download page lists them
  • 1.0LGPO.zip
    Microsoft Security Compliance Toolkit artifacts · · 519 KB

    Revised 29 Sep 2026: the text changed

  • 1.0Microsoft 365 Apps for Enterprise 2512.zip
    Microsoft Security Compliance Toolkit artifacts · · 871 KB

    Revised 29 Sep 2026: the text changed

  • 1.0Microsoft Edge v151 Security Baseline.zip
    Microsoft Security Compliance Toolkit artifacts · · 455 KB

    Revised 29 Sep 2026: the text changed

  • 1.0PolicyAnalyzer.zip
    Microsoft Security Compliance Toolkit artifacts · · 1.5 MB

    Revised 29 Sep 2026: the text changed

11 more open

Sizes and dates are what Microsoft's download page reports; ChangeIntel does not download or check the files.

ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Data comes from public sources listed on Sources; every item links to its original page. Dates and statuses can change after they are read. Privacy: no accounts or analytics, and your preferences stay in your browser. Terms: information, not advice. Built by Evotec. This is the public demo. It can also run on your own server, with your Microsoft 365 tenant and device data kept inside your network; Evotec can help you deploy and extend it.