● Live advisory feed

Security Advisory Fusion for CSIRTs, SOCs & Defenders

Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.

Daily Briefings IntelFusions

Advisories tracked

21,063

Known exploited

1,782

Sources online

Last sync

1H AGO

9,433 records · page 62 / 189 · nvd firehose hidden — show all

CVE-2026-66318: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

highCVSS 8.1CVE-2026-66318 msrc2026-07-14

CVE-2026-57991: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

highCVSS 7.4CVE-2026-57991 msrc2026-07-14

CVE-2026-58276: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

highCVSS 7.5CVE-2026-58276 msrc2026-07-14

CVE-2026-50327: Windows Media Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.

highCVSS 7.8CVE-2026-50327 msrc2026-07-14

CVE-2026-50368: Windows Active Directory Federation Services Denial of Service Vulnerability

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

highCVSS 7.5CVE-2026-50368 msrc2026-07-14

CVE-2026-38968: ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

criticalCVSS 9.8CVE-2026-38968 msrc2026-07-14

CVE-2026-50321: Windows USB Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.

highCVSS 7.8CVE-2026-50321 msrc2026-07-14

CVE-2026-13794: Chromium: CVE-2026-13794 Insufficient validation of untrusted input in WebAppInstalls

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-13794 msrc2026-07-14

CVE-2026-53366: ipv4: account for fraggap on the paged allocation path

highCVSS 8.5CVE-2026-53366 msrc2026-07-14

CVE-2026-15714: Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string

mediumCVSS 6.5CVE-2026-15714 msrc2026-07-14

CVE-2026-63796: ocfs2: reject oversized group bitmap descriptors

highCVSS 7.1CVE-2026-63796 msrc2026-07-14

CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages

highCVSS 7.1CVE-2026-63879 msrc2026-07-14

CVE-2026-50414: Windows Media Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.

highCVSS 7.5CVE-2026-50414 msrc2026-07-14

CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

lowCVSS 3.7CVE-2026-42955 msrc2026-07-14

CVE-2026-50376: Windows Remote Desktop Client Information Disclosure Vulnerability

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

mediumCVSS 6.5CVE-2026-50376 msrc2026-07-14

CVE-2026-13953: Chromium: CVE-2026-13953 Inappropriate implementation in SplitView

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-13953 msrc2026-07-14

CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

mediumCVSS 5.9CVE-2026-55991 msrc2026-07-14

CVE-2026-44508: Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate.

mediumCVSS 5.3CVE-2026-44508 msrc2026-07-14

CVE-2026-59676: Local File Deletion Attack Vector in rm_rf() in seunshare

unknownCVE-2026-59676 msrc2026-07-14

CVE-2026-50486: Windows Runtime Elevation of Privilege Vulnerability

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

highCVSS 7.8CVE-2026-50486 msrc2026-07-14

CVE-2026-50526: .NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

highCVSS 7CVE-2026-50526 msrc2026-07-14

CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

mediumCVSS 5.5CVE-2026-64425 msrc2026-07-14

CVE-2026-55016: Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

mediumCVSS 4.6CVE-2026-55016 msrc2026-07-14

CVE-2026-50651: .NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

highCVSS 7.5CVE-2026-50651 msrc2026-07-14

CVE-2026-50657: Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.

mediumpublic exploitCVSS 4.7CVE-2026-50657 msrc2026-07-14

CVE-2026-59843: Libssh: libssh: denial of service via zero advertised channel packet size

mediumCVSS 6.5CVE-2026-59843 msrc2026-07-14

CVE-2026-59845: Libssh: libssh: denial of service via unchecked proxycommand fork() failure

mediumCVSS 5.3CVE-2026-59845 msrc2026-07-14

CVE-2026-50666: Windows Remote Access Elevation of Privilege Vulnerability

Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network.

highCVSS 8.8CVE-2026-50666 msrc2026-07-14

CVE-2026-50668: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack.

mediumCVSS 6.8CVE-2026-50668 msrc2026-07-14

CVE-2026-50682: Active Directory Denial of Service Vulnerability

Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network.

highCVSS 7.1CVE-2026-50682 msrc2026-07-14

CVE-2026-14107: Chromium: CVE-2026-14107 Use after free in Scheduling

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-14107 msrc2026-07-14