BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 10:01 UTC

1,693 high CVEs published in the 120 days to Nov 5, 2026 · page 65 of 68

  1. PublishedJul 14, 2026
    CVE-2026-503127.8 HIGH
    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    4.7MEDIUM3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  2. PublishedJul 14, 2026
    CVE-2026-503077.8 HIGH
    Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  3. PublishedJul 14, 2026
    CVE-2026-457568.2 HIGH
    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.
    ScoreSeverityVersionVector String
    8.2HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  4. PublishedJul 14, 2026
    CVE-2026-450778.3 HIGH
    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
    8.6HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  5. PublishedJul 14, 2026
    CVE-2026-450747.6 HIGH
    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
    ScoreSeverityVersionVector String
    7.6HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
  6. PublishedJul 14, 2026
    CVE-2026-586407.8 HIGH
    Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  7. PublishedJul 14, 2026
    CVE-2026-586088.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  8. PublishedJul 14, 2026
    CVE-2026-585267.8 HIGH
    Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  9. PublishedJul 14, 2026
    CVE-2026-579797.5 HIGH
    Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    6.5MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  10. PublishedJul 14, 2026
    CVE-2026-561698.8 HIGH
    Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    8.1HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  11. PublishedJul 14, 2026
    CVE-2026-550028.8 HIGH
    External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  12. PublishedJul 14, 2026
    CVE-2026-549928.4 HIGH
    Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  13. PublishedJul 14, 2026
    CVE-2026-549917.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  14. PublishedJul 14, 2026
    CVE-2026-549909.8 CRITICAL
    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  15. PublishedJul 14, 2026
    CVE-2026-549897.8 HIGH
    Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  16. PublishedJul 14, 2026
    CVE-2026-541297.8 HIGH
    Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. PublishedJul 14, 2026
    CVE-2026-541278.4 HIGH
    Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    8.4HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.4HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  18. PublishedJul 14, 2026
    CVE-2026-541127.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  19. PublishedJul 14, 2026
    CVE-2026-541078.8 HIGH
    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  20. PublishedJul 14, 2026
    CVE-2026-497917.8 HIGH
    Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.1HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
  21. PublishedJul 14, 2026
    CVE-2026-497907.8 HIGH
    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  22. PublishedJul 14, 2026
    CVE-2026-497897.8 HIGH
    Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  23. PublishedJul 14, 2026
    CVE-2026-491848.4 HIGH
    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  24. PublishedJul 14, 2026
    CVE-2026-491717.8 HIGH
    Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
  25. PublishedJul 14, 2026
    CVE-2026-491698.8 HIGH
    Use after free in DNS Server allows an authorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    8.0HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 10:30 UTC.