● Live advisory feed

Security Advisory Fusion for CSIRTs, SOCs & Defenders

Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.

Daily Briefings IntelFusions

Advisories tracked

21,127

Known exploited

1,782

Sources online

Last sync

47M AGO

9,456 records · page 68 / 190 · nvd firehose hidden — show all

CVE-2026-49788: HTTP/2 Denial of Service Vulnerability

Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.

highCVSS 7.5CVE-2026-49788 msrc2026-07-14

CVE-2026-18007: Chromium: CVE-2026-18007 Inappropriate implementation in Input

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-18007 msrc2026-07-14

CVE-2026-18004: Chromium: CVE-2026-18004 Insufficient policy enforcement in Speech

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-18004 msrc2026-07-14

CVE-2026-49806: Windows USB Print Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

highCVSS 7CVE-2026-49806 msrc2026-07-14

CVE-2026-18000: Chromium: CVE-2026-18000 Insufficient policy enforcement in USB

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-18000 msrc2026-07-14

CVE-2026-50297: Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

highCVSS 7CVE-2026-50297 msrc2026-07-14

CVE-2026-50384: Windows Clip Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Service allows an authorized attacker to elevate privileges locally.

highCVSS 7CVE-2026-50384 msrc2026-07-14

CVE-2026-35425: Azure API Management (APIM) Remote Code Execution Vulnerability

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

highCVSS 8CVE-2026-35425 msrc2026-07-14

CVE-2026-57106: Data Quality Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

criticalCVSS 10CVE-2026-57106 msrc2026-07-14

CVE-2026-16807: Chromium: CVE-2026-16807 Out of bounds write in Codecs

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-16807 msrc2026-07-14

CVE-2026-14258: Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

mediumCVSS 6.5CVE-2026-14258 msrc2026-07-14

CVE-2026-10536: HTTP/2 stream-dependency tree UAF

mediumCVSS 5.5CVE-2026-10536 msrc2026-07-14

CVE-2026-50381: Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability

Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.

mediumCVSS 5.5CVE-2026-50381 msrc2026-07-14

CVE-2026-14355: ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

mediumCVSS 5.6CVE-2026-14355 msrc2026-07-14

CVE-2026-55952: TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

unknownCVE-2026-55952 msrc2026-07-14

CVE-2026-50392: Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

highCVSS 7CVE-2026-50392 msrc2026-07-14

CVE-2026-50328: Windows Server Update Service (WSUS) Tampering Vulnerability

Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

highCVSS 7.5CVE-2026-50328 msrc2026-07-14

CVE-2026-50678: Microsoft Excel Information Disclosure Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

mediumCVSS 6.6CVE-2026-50678 msrc2026-07-14

CVE-2026-50360: Windows SMB Server Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

highCVSS 8.8CVE-2026-50360 msrc2026-07-14

CVE-2026-55948: Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

highCVSS 7.8CVE-2026-55948 msrc2026-07-14

CVE-2026-56289: Loop with Unreachable Exit Condition in GNU patch

unknownCVE-2026-56289 msrc2026-07-14

CVE-2026-50393: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

highCVSS 7CVE-2026-50393 msrc2026-07-14

CVE-2026-60000: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

lowCVSS 3.7CVE-2026-60000 msrc2026-07-14

CVE-2026-57991: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

highCVSS 7.4CVE-2026-57991 msrc2026-07-14

CVE-2026-50368: Windows Active Directory Federation Services Denial of Service Vulnerability

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

highCVSS 7.5CVE-2026-50368 msrc2026-07-14

CVE-2026-38968: ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

criticalCVSS 9.8CVE-2026-38968 msrc2026-07-14

CVE-2026-58276: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

highCVSS 7.5CVE-2026-58276 msrc2026-07-14

CVE-2026-50327: Windows Media Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.

highCVSS 7.8CVE-2026-50327 msrc2026-07-14

CVE-2026-50321: Windows USB Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.

highCVSS 7.8CVE-2026-50321 msrc2026-07-14

CVE-2026-13794: Chromium: CVE-2026-13794 Insufficient validation of untrusted input in WebAppInstalls

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-13794 msrc2026-07-14

CVE-2026-53366: ipv4: account for fraggap on the paged allocation path

highCVSS 8.5CVE-2026-53366 msrc2026-07-14

CVE-2026-15714: Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string

mediumCVSS 6.5CVE-2026-15714 msrc2026-07-14

CVE-2026-63796: ocfs2: reject oversized group bitmap descriptors

highCVSS 7.1CVE-2026-63796 msrc2026-07-14

CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages

highCVSS 7.1CVE-2026-63879 msrc2026-07-14

CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

lowCVSS 3.7CVE-2026-42955 msrc2026-07-14

CVE-2026-50414: Windows Media Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.

highCVSS 7.5CVE-2026-50414 msrc2026-07-14

CVE-2026-50376: Windows Remote Desktop Client Information Disclosure Vulnerability

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.

mediumCVSS 6.5CVE-2026-50376 msrc2026-07-14

CVE-2026-13953: Chromium: CVE-2026-13953 Inappropriate implementation in SplitView

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

unknownCVE-2026-13953 msrc2026-07-14

CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

mediumCVSS 5.9CVE-2026-55991 msrc2026-07-14

CVE-2026-44508: Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate.

mediumCVSS 5.3CVE-2026-44508 msrc2026-07-14