Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,515 results · page 11 of 191
Oct 15, 2026A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.CVE-2026-79821 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.2
A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.
- Product
- HPE NonStop SOAP 4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.CVE-2026-76668 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.3
A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.
- Product
- HPE NonStop Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.CVE-2026-76667 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.7
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.CVE-2026-76666 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.7
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.CVE-2026-76665 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.1
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operationsCVE-2026-76664 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.4
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.CVE-2026-76663 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
- Product
- HPE NonStop TELSERV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.CVE-2026-76662 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.9
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
- Product
- HPE NonStop TELSERV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.CVE-2026-76661 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.6
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
- Product
- HPE NonStop QIOMON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.CVE-2026-76660 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.7
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
- Product
- HPE NonStop CIPSAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.CVE-2026-76659 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
- Product
- HPE NonStop TCP/IP UTILITIES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed undeCVE-2026-76656 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.
- Product
- HPE NonStop TCP/IP UTILITIES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruptionCVE-2026-73799 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
- Product
- HPE NonStop SNMP Trap Multiplexer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109968 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code executionCVE-2026-76655 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution
- Product
- HPE NonStop SNMP Trap Multiplexer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.CVE-2026-73798 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.2
A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.
- Product
- HPE NonStop DNS 9.2.3 Non Secure Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.CVE-2026-73797 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.
- Product
- HPE NonStop TSQLFIL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.CVE-2026-73796 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.4
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.
- Product
- HPE NonStop TSQLEXE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service.CVE-2026-73795 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.4
A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service.
- Product
- HPE NonStop TMF Auditread2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers).CVE-2026-100229 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in gst-plugins-base.CVE-2026-86476 · Other software · Red Hat · reported by Red HatHigh 8.4
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)CVE-2026-73794 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.6
HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)
- Product
- HPE NonStop MODULAR NSJ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.CVE-2026-73793 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.9
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
- Product
- HPE NonStop Middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.CVE-2026-73792 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comLow 3.8
A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.
- Product
- HPE NonStop Java JToolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.CVE-2026-73791 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comLow 2
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
- Product
- HPE NonStop Hpjmeter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109971 · Other software · Red Hat · reported by Red HatMedium 4.7
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109970 · Other software · Red Hat · reported by Red HatMedium 4.7
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109969 · Other software · Red Hat · reported by Red HatMedium 4.7
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux).CVE-2026-100231 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.CVE-2026-73790 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.2
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.
- Product
- HPE NonStop iTP WebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-102855 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-97783 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code CVE-2026-97781 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97780 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-97779 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97778 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97777 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97776 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97775 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.CVE-2026-97774 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97773 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97772 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97771 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97770 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97769 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97768 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97767 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97766 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97765 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.