CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-96203: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-96199: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96187: Microsoft Edge (Chromium-based) (High, CVSS 7.4)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-96192: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96196: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
-
CVE-2026-96198: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-88077: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-85890: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-85897: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-85899: Microsoft Edge (Chromium-based) (High, CVSS 8.1)
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
-
CVE-2026-114148: Microsoft .NET 10.0 installed on Linux (High, CVSS 7.8)
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
CVE-2026-62765: Microsoft Edge (Chromium-based) (High, CVSS 7.5)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-85898: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-83831: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-97785: Microsoft Entra application proxy (Critical, CVSS 10)
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-83938: Microsoft Azure Kubernetes Configuration Service (Critical, CVSS 10)
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-108456: Microsoft Azure AI Foundry (High, CVSS 7.7)
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
-
CVE-2026-80097: Microsoft Authenticator for Android (High, CVSS 8.6)
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
CVE-2022-21894: Microsoft Windows 10 Version 1809 (Medium, CVSS 4.4)
Secure Boot Security Feature Bypass Vulnerability
-
CVE-2021-42287: Microsoft Active Directory (High, CVSS 7.5)
Active Directory Domain Services Elevation of Privilege Vulnerability
-
CVE-2021-42278: Microsoft Active Directory (High, CVSS 7.5)
Active Directory Domain Services Elevation of Privilege Vulnerability