Skip to main content

Patch advisories

Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.

RSS Export CSV Brief (PDF) Slides (PPTX)
Microsoft release 1,598 Other vendors (KEV) 1,364 Linux 1,019 Vendor bulletins 84 Lifecycle 190

Patch these first

Top 10 of 11: exploited, disclosed before a patch, or “Exploitation More Likely” and network-reachable
  1. 1CVE-2026-96951Microsoft — Windows Shell Security Feature Bypass VulnerabilityActively exploited
  2. 2CVE-2026-108398Microsoft — .NET Framework Security Feature Bypass VulnerabilityPublicly disclosed before patch
  3. 3CVE-2026-92707Microsoft — MessagePack-CSharp Denial of Service VulnerabilityPublicly disclosed before patch
  4. 4CVE-2026-100214Microsoft — Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  5. 5CVE-2026-102217Microsoft — WebDAV Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
  6. 6CVE-2026-88159Microsoft — Windows Background Intelligent Transfer Service (BITS) Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  7. 7CVE-2026-70279Microsoft — Microsoft Exchange Server Spoofing VulnerabilityExploitation More Likely, network-reachable
  8. 8CVE-2026-96940Microsoft — Microsoft Exchange Server Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
  9. 9CVE-2026-70571Microsoft — Microsoft Exchange Server Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  10. 10CVE-2026-70229Microsoft — Windows Active Directory Domain Services Remote Code Execution VulnerabilityExploitation More Likely, network-reachable

Microsoft CVEs

Microsoft Security Update Guide · 1,598 CVEs
Microsoft CVEs, rows 1526 to 1550
#CVE · titleEVRSCVSSEPSSSignal
1526 CVE-2026-98346Microsoft — wifi: cfg80211: don't get the radio mask for netdev-less wdevsEPSS 0.2% 0 — 0.2% —
1527 CVE-2026-98448Microsoft — xfs: release orphanage dir inode if chown failsEPSS 0.2% 0 — 0.2% —
1528 CVE-2026-98223Microsoft — mm: filemap: retain mapped dropbehind foliosEPSS 0.2% 0 — 0.2% —
1529 CVE-2026-98224Microsoft — mm/vma: correctly unaccount on mmap_prepare() failureEPSS 0.2% 0 — 0.2% —
1530 CVE-2026-98226Microsoft — mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage countEPSS 0.2% 0 — 0.2% —
1531 CVE-2026-98274Microsoft — net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()EPSS 0.2% 0 — 0.2% —
1532 CVE-2026-98313Microsoft — drm/msm/dp: skip PUSH_IDLE when the link was never enabledEPSS 0.2% 0 — 0.2% —
1533 CVE-2026-98446Microsoft — xfs: don't let hidden_space go negative in xfs_metafile_resv_initEPSS 0.2% 0 — 0.2% —
1534 CVE-2026-98868Microsoft — dm-pcache: reject a kset that overruns its segmentEPSS 0.2% 0 — 0.2% —
1535 CVE-2026-98440Microsoft — KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destructionEPSS 0.2% 0 — 0.2% —
1536 CVE-2026-98445Microsoft — xfs: don't let memory failures leak blocks and kill repairsEPSS 0.2% 0 — 0.2% —
1537 CVE-2026-98475Microsoft — s390/cmf: Fix virtual vs physical address confusionEPSS 0.2% 0 — 0.2% —
1538 CVE-2026-98611Microsoft — bpf: Check params size before reading reserved fieldsEPSS 0.2% 0 — 0.2% —
1539 CVE-2026-98615Microsoft — eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailboxEPSS 0.2% 0 — 0.2% —
1540 CVE-2026-98641Microsoft — bpf, arm64: set up the frame pointer for the exception callbackEPSS 0.2% 0 — 0.2% —
1541 CVE-2026-98680Microsoft — iio: accel: kionix-kx022a: Prevent memory leak and fix stateEPSS 0.2% 0 — 0.2% —
1542 CVE-2026-98702Microsoft — wifi: mac80211: reject invalid 320 MHz CSA bandwidthEPSS 0.2% 0 — 0.2% —
1543 CVE-2026-98713Microsoft — KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGTEPSS 0.2% 0 — 0.2% —
1544 CVE-2026-98728Microsoft — tpm: fix off-by-four bounds check in tpm2_get_random()EPSS 0.2% 0 — 0.2% —
1545 CVE-2026-98730Microsoft — Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()EPSS 0.2% 0 — 0.2% —
1546 CVE-2026-98781Microsoft — drm/mediatek: Fix pdev reference leak in mtk_drm_bind()EPSS 0.2% 0 — 0.2% —
1547 CVE-2026-98782Microsoft — drm/mediatek: Fix ovl adaptor platform device leakEPSS 0.2% 0 — 0.2% —
1548 CVE-2026-98783Microsoft — drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform deviceEPSS 0.2% 0 — 0.2% —
1549 CVE-2026-98791Microsoft — net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereferenceEPSS 0.2% 0 — 0.2% —
1550 CVE-2026-98841Microsoft — virt: vmgenid: set driver_data before registering notification handlersEPSS 0.2% 0 — 0.2% —
Showing 1,526–1,550 of 1,598

CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.

Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.