EventsSecuring Finance in the Age of AI · Secure.com X ZIG Finance · London, 12 NovRegister now

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

Updated 10 Nov 2026

  1. PublishedJul 14, 2026
    CVE-2026-450778.3 HIGH
    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
    8.6HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  2. PublishedJul 14, 2026
    CVE-2026-450747.6 HIGH
    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
    ScoreSeverityVersionVector String
    7.6HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
  3. PublishedJul 14, 2026
    CVE-2026-586407.8 HIGH
    Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  4. PublishedJul 14, 2026
    CVE-2026-586088.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  5. PublishedJul 14, 2026
    CVE-2026-585267.8 HIGH
    Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  6. PublishedJul 14, 2026
    CVE-2026-579797.5 HIGH
    Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    6.5MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  7. PublishedJul 14, 2026
    CVE-2026-561698.8 HIGH
    Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    8.1HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  8. PublishedJul 14, 2026
    CVE-2026-550028.8 HIGH
    External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  9. PublishedJul 14, 2026
    CVE-2026-549928.4 HIGH
    Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  10. PublishedJul 14, 2026
    CVE-2026-549917.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  11. PublishedJul 14, 2026
    CVE-2026-549909.8 CRITICAL
    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  12. PublishedJul 14, 2026
    CVE-2026-549897.8 HIGH
    Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  13. PublishedJul 14, 2026
    CVE-2026-541297.8 HIGH
    Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  14. PublishedJul 14, 2026
    CVE-2026-541278.4 HIGH
    Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    8.4HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.4HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  15. PublishedJul 14, 2026
    CVE-2026-541127.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  16. PublishedJul 14, 2026
    CVE-2026-541078.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. PublishedJul 14, 2026
    CVE-2026-497917.8 HIGH
    Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.1HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
  18. PublishedJul 14, 2026
    CVE-2026-497907.8 HIGH
    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  19. PublishedJul 14, 2026
    CVE-2026-497897.8 HIGH
    Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  20. PublishedJul 14, 2026
    CVE-2026-491848.4 HIGH
    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  21. PublishedJul 14, 2026
    CVE-2026-491717.8 HIGH
    Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
  22. PublishedJul 14, 2026
    CVE-2026-491698.8 HIGH
    Use after free in DNS Server allows an authorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    8.0HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
  23. PublishedJul 14, 2026
    CVE-2026-491677.8 HIGH
    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    4.7MEDIUM3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  24. PublishedJul 14, 2026
    CVE-2026-472967.5 HIGH
    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  25. PublishedJul 14, 2026
    CVE-2026-448067.5 HIGH
    Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    5.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Load more

Sources

  • NVD
  • CVE.org
  • CISA KEV
  • FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-10 11:15 UTC.