Microsoft Patch Tuesday vulnerability dashboard
PatchaPalooza tracks 31,931 Microsoft vulnerabilities across 83 Patch Tuesday releases since January 2020, combining Microsoft's advisories with CISA KEV, EPSS, NVD, public exploits and detection rules.
Latest release: November 2026 Patch Tuesday
1,547 vulnerabilities, 60 critical, 1 exploited in the wild, 0 publicly disclosed.
| CVE | Title | Severity | CVSS | Impact | Status |
|---|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | Medium | 6.5 | Spoofing | Exploited |
| CVE-2026-112967 | Windows Xbox Live Networking Service Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-116928 | Windows Search Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-116945 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-119958 | Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-85844 | Windows Kerberos Elevation of Privilege Vulnerability | Critical | 9.8 | Elevation of Privilege | |
| CVE-2026-88218 | Windows DNS Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-88234 | Windows iSCSI Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-88243 | Windows DHCP Server Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-95882 | Microsoft DirectMusic Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-95901 | Microsoft DirectMusic Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-96067 | Microsoft Color Management Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-96078 | Microsoft Color Management Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-96157 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-118740 | Aspire Security Feature Bypass Vulnerability | Critical | 9.1 | Security Feature Bypass | |
| CVE-2026-95962 | Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability | Critical | 9 | Remote Code Execution | |
| CVE-2026-119990 | Azure OpenAI Elevation of Privilege Vulnerability | Critical | 9.8 | Elevation of Privilege | |
| CVE-2026-109469 | Entra Device Registration Elevation of Privilege Vulnerability | Critical | 10 | Elevation of Privilege | |
| CVE-2026-120002 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Critical | 9.9 | Elevation of Privilege | |
| CVE-2026-120779 | Visual Studio Code Remote Code Execution Vulnerability | Critical | 9.6 | Remote Code Execution | |
| CVE-2026-114162 | Microsoft Graph Elevation of Privilege Vulnerability | Critical | 9.1 | Elevation of Privilege | |
| CVE-2026-109454 | Microsoft Office SharePoint Spoofing Vulnerability | Critical | 9 | Spoofing | |
| CVE-2026-114146 | ASP.NET Core Elevation of Privilege Vulnerability | Critical | 9 | Elevation of Privilege | |
| CVE-2026-80095 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Critical | 9 | Elevation of Privilege | |
| CVE-2026-109467 | Azure DevOps Server Remote Code Execution Vulnerability | Critical | 9.9 | Remote Code Execution |
Showing 25 of 61.
Recently added to CISA KEV
| CVE | Title | Severity | CVSS | Impact | Status | Added to KEV | Release |
|---|---|---|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | Medium | 6.5 | Spoofing | Exploited | November 2026 | |
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | High | 8.8 | Security Feature Bypass | Exploited | October 2026 | |
| CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | August 2026 | ||
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | September 2026 | |
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | September 2026 | |
| CVE-2026-55040 | Microsoft SharePoint Server Security Feature Bypass Vulnerability | Critical | 9.1 | Security Feature Bypass | July 2026 | ||
| CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | April 2026 | ||
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | Exploited | August 2026 | |
| CVE-2026-50522 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | July 2026 | ||
| CVE-2026-58644 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | Exploited | July 2026 | |
| CVE-2026-56164 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Medium | 5.3 | Elevation of Privilege | Exploited | July 2026 | |
| CVE-2026-56155 | Active Directory Federation Services Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | July 2026 | |
| CVE-2026-45659 | Microsoft SharePoint Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | May 2026 | ||
| CVE-2026-45498 | Microsoft Defender Denial of Service Vulnerability | Medium | 4 | Denial of Service | Exploited | May 2026 | |
| CVE-2026-41091 | Microsoft Defender Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | May 2026 |
Recently revised
| CVE | Title | Severity | CVSS | Impact | Status | Revised | Release |
|---|---|---|---|---|---|---|---|
| CVE-2026-113749 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability | High | 7.5 | Remote Code Execution | November 2026 | ||
| CVE-2026-119856 | Win32k Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | November 2026 | ||
| CVE-2026-121680 | Windows NTLM Spoofing Vulnerability | High | 7.5 | Spoofing | November 2026 | ||
| CVE-2026-125350 | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | High | 8.8 | Edge - Chromium | November 2026 | ||
| CVE-2026-88217 | Windows Graphics Kernel Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | November 2026 | ||
| CVE-2026-95922 | Windows Graphics Kernel Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | November 2026 | ||
| CVE-2026-95932 | Windows Graphics Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | November 2026 | ||
| CVE-2026-95942 | Windows Graphics Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | November 2026 | ||
| CVE-2026-95948 | Windows Graphics Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | November 2026 | ||
| CVE-2026-95953 | Windows Graphics Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | November 2026 | ||
| CVE-2026-96126 | Windows Graphics Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | November 2026 | ||
| CVE-2026-96144 | Windows Graphics Kernel Information Disclosure Vulnerability | Medium | 4.7 | Information Disclosure | November 2026 | ||
| CVE-2026-96150 | Microsoft Windows Codecs Library Information Disclosure Vulnerability | Medium | 5.6 | Information Disclosure | November 2026 | ||
| CVE-2026-111497 | Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder | High | 8.1 | Elevation of Privilege | Publicly disclosed | October 2026 | |
| CVE-2026-119990 | Azure OpenAI Elevation of Privilege Vulnerability | Critical | 9.8 | Elevation of Privilege | November 2026 |
Browse by product family
Open Source Software · Windows · ESU · Browser · Mariner · Microsoft Office · Developer Tools · Azure · SQL Server · Other · Microsoft Dynamics · Apps · Server Software · System Center · Exchange Server · Device