Microsoft Patch Tuesday vulnerability dashboard
PatchaPalooza tracks 30,384 Microsoft vulnerabilities across 83 Patch Tuesday releases since January 2020, combining Microsoft's advisories with CISA KEV, EPSS, NVD, public exploits and detection rules.
Latest release: November 2026 Patch Tuesday
93 vulnerabilities, 7 critical, 0 exploited in the wild, 0 publicly disclosed.
| CVE | Title | Severity | CVSS | Impact | Status |
|---|---|---|---|---|---|
| CVE-2026-109469 | Entra Device Registration Elevation of Privilege Vulnerability | Critical | 10 | Elevation of Privilege | |
| CVE-2026-118309 | Chromium CVE-2026-118309: Incorrect reference resolution | Critical | 9.6 | ||
| CVE-2026-118321 | Chromium CVE-2026-118321: Use after free | Critical | 9.6 | ||
| CVE-2026-119261 | Chromium CVE-2026-119261: Improper input validation | Critical | 9.6 | ||
| CVE-2026-119263 | Chromium CVE-2026-119263: Memory corruption | Critical | 9.6 | ||
| CVE-2026-120640 | CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields | Critical | 9.1 | ||
| CVE-2026-120641 | CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths | Critical | 9.1 |
Recently added to CISA KEV
| CVE | Title | Severity | CVSS | Impact | Status | Added to KEV | Release |
|---|---|---|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | High | 8.8 | Security Feature Bypass | Exploited | October 2026 | |
| CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | August 2026 | ||
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | September 2026 | |
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | September 2026 | |
| CVE-2026-55040 | Microsoft SharePoint Server Security Feature Bypass Vulnerability | Critical | 9.1 | Security Feature Bypass | July 2026 | ||
| CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | April 2026 | ||
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | Exploited | August 2026 | |
| CVE-2026-50522 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | July 2026 | ||
| CVE-2026-58644 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | Exploited | July 2026 | |
| CVE-2026-56164 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Medium | 5.3 | Elevation of Privilege | Exploited | July 2026 | |
| CVE-2026-56155 | Active Directory Federation Services Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | July 2026 | |
| CVE-2026-45659 | Microsoft SharePoint Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | May 2026 | ||
| CVE-2026-45498 | Microsoft Defender Denial of Service Vulnerability | Medium | 4 | Denial of Service | Exploited | May 2026 | |
| CVE-2026-41091 | Microsoft Defender Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | May 2026 | |
| CVE-2026-42897 | Microsoft Exchange Server Spoofing Vulnerability | High | 8.1 | Spoofing | Exploited | May 2026 |
Recently revised
| CVE | Title | Severity | CVSS | Impact | Status | Revised | Release |
|---|---|---|---|---|---|---|---|
| CVE-2026-83844 | Windows Paint Remote Code Execution Vulnerability | High | 8.1 | Remote Code Execution | October 2026 | ||
| CVE-2026-57083 | Windows Media Photo Codec Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | July 2026 | ||
| CVE-2026-57084 | Windows File Explorer Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | July 2026 | ||
| CVE-2026-62740 | Windows Imaging Component Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | August 2026 | ||
| CVE-2026-62877 | Windows Win32k Elevation of Privilege Vulnerability | High | 7.8 | Remote Code Execution | August 2026 | ||
| CVE-2026-69499 | Windows Imaging Component Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | September 2026 | ||
| CVE-2026-69576 | Graphic Fonts Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | September 2026 | ||
| CVE-2026-69609 | Win32k Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | September 2026 | ||
| CVE-2026-73013 | Windows Imaging Component Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | September 2026 | ||
| CVE-2026-77491 | Windows GDI Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | September 2026 | ||
| CVE-2026-88097 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | High | 8.1 | Edge - Chromium | September 2026 | ||
| CVE-2026-83831 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 | ||
| CVE-2026-85890 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 | ||
| CVE-2026-85897 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 | ||
| CVE-2026-85898 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 |
Browse by product family
Open Source Software · Windows · ESU · Browser · Mariner · Microsoft Office · Developer Tools · Azure · SQL Server · Microsoft Dynamics · Apps · Other · Server Software · System Center · Exchange Server · Device