Spremljamo ranljivosti v izdelkih največjih proizvajalcev, kot so Microsoft, Cisco, Fortinet, Citrix in drugi. Izberite proizvajalca za seznam njegovih aktivnih ranljivosti in naših člankov.
Microsoft: ranljivosti v zadnjem letu
| CVE | CVSS | EPSS | CISA KEV | Proizvajalec | Opis (NVD, angleško) |
|---|---|---|---|---|---|
| CVE-2026-85880 | 7,8 Visoko | 3,6 % | Aktivno izkoriščana od 8. 9. 2026 | Microsoft | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. |
| CVE-2026-81963 | 7,8 Visoko | 0,4 % | Aktivno izkoriščana od 8. 9. 2026 | Microsoft | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
| CVE-2026-56155 | 7,8 Visoko | 0,3 % | Aktivno izkoriščana od 14. 7. 2026 | Microsoft | Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-68820 | 7 Visoko | 0,3 % | Aktivno izkoriščana od 11. 8. 2026 | Microsoft | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-59124 | 9,8 Kritično | 1,5 % | – | Microsoft | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69586 | 9,8 Kritično | 1,0 % | – | Microsoft | Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72979 | 9,8 Kritično | 1,0 % | – | Microsoft | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-73009 | 9,8 Kritično | 1,0 % | – | Microsoft | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72982 | 9,8 Kritično | 1,0 % | – | Microsoft | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
| CVE-2026-62784 | 8,8 Visoko | 0,9 % | – | Microsoft | Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to execute code over a network. |
| CVE-2026-69712 | 8,8 Visoko | 0,9 % | – | Microsoft | Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network. |
| CVE-2026-69598 | 8,8 Visoko | 0,8 % | – | Microsoft | Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
| CVE-2026-73006 | 8,8 Visoko | 0,8 % | – | Microsoft | Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
| CVE-2026-62744 | 8,8 Visoko | 0,8 % | – | Microsoft | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-50414 | 8,8 Visoko | 0,6 % | – | Microsoft | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-70125 | 8,8 Visoko | 0,4 % | – | Microsoft | Microsoft Office Outlook Remote Code Execution Vulnerability |
| CVE-2026-78501 | 8,6 Visoko | 0,5 % | – | Microsoft | Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-54128 | 8,4 Visoko | 0,4 % | – | Microsoft | Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally. |
| CVE-2026-72987 | 8,1 Visoko | 0,7 % | – | Microsoft | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69732 | 8,1 Visoko | 0,7 % | – | Microsoft | Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69301 | 8 Visoko | 0,8 % | – | Microsoft | Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69322 | 8 Visoko | 0,8 % | – | Microsoft | Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68880 | 8 Visoko | 0,8 % | – | Microsoft | Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68878 | 8 Visoko | 0,8 % | – | Microsoft | Stack-based buffer overflow in Windows Fast FAT Driver allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-68894 | 8 Visoko | 0,8 % | – | Microsoft | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-57095 | 7,8 Visoko | 0,5 % | – | Microsoft | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-50448 | 7,8 Visoko | 0,5 % | – | Microsoft | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
| CVE-2026-69328 | 7,8 Visoko | 0,5 % | – | Microsoft | Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally. |
| CVE-2026-58613 | 7,8 Visoko | 0,4 % | – | Microsoft | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-62751 | 7,8 Visoko | 0,3 % | – | Microsoft | Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
Naši članki: Microsoft
Microsoft MFA AuthQuake Flaw: The Silent Threat of Unlimited Brute-Force Attempts
Critical Vulnerability in Microsoft MFA Cybersecurity researchers have identified a critical vulnerability in Microsoft’s multi-factor authentication (MFA) implementation. This flaw allows attackers to bypass MFA effortlessly,...
“Microsoft’s Latest Security Update: Patching 72 Flaws, Including Critical CLFS Vulnerability”
Microsoft's December Patch Tuesday: A Critical Update Microsoft closed out its Patch Tuesday updates for 2024 with significant attention to security. The company addressed 72 security...
Boost Your IT Security: Microsoft’s Latest Fixes for AI, Cloud, and ERP Vulnerabilities
Microsoft Addresses Security Flaws in AI and Cloud Services Microsoft recently took action by addressing four significant security vulnerabilities that affect its artificial intelligence (AI), cloud,...
Phishing-as-a-Service Rockstar 2FA Targets Microsoft 365 Users with AiTM Attacks
Understanding the Threat: Rockstar 2FA Phishing-as-a-Service Toolkit Cybersecurity researchers have raised alarms about a new phishing threat known as Rockstar 2FA. This phishing-as-a-service (PhaaS) toolkit targets...
Microsoft Meta and DOJ Crack Down on Global Cybercrime and Fraudulent Networks
Tackling Cybercrime: Efforts by Meta Platforms, Microsoft, and the U.S. Department of Justice Cybercrime remains a significant threat to individuals and organizations worldwide. Recently, Meta Platforms,...
Boost Your Cybersecurity: Microsoft’s Latest Security Fixes Unveiled
Microsoft Addresses Critical Security Flaws On Tuesday, Microsoft revealed that two significant security vulnerabilities affecting Windows NT LAN Manager (NTLM) and Task Scheduler are now being...
Microsoft Fixes 90 New Flaws: Actively Exploited NTLM and Task Scheduler Vulnerabilities Patched
Microsoft recently revealed two critical security flaws concerning NT LAN Manager (NTLM) and Task Scheduler that are currently being actively exploited. These vulnerabilities are part of...
VEILDrive Attack: Evading Detection with Microsoft Services
Understanding the VEILDrive Threat Campaign The ongoing VEILDrive threat campaign has been observed using legitimate Microsoft services such as Teams, SharePoint, Quick Assist, and OneDrive. This...
The Rise of Chinese Botnets: Microsoft’s Warning on Router Exploits for Credential Theft
Microsoft Warns of Chinese Botnet Quad7 and its Evasive Techniques Microsoft has unveiled that a Chinese threat actor known as Storm-0940 is using the Quad7 botnet...