Windows security vulnerabilities
Windows client and server vulnerabilities with vendor and CISA KEV context when published.
Built for IT administrators and security teams.
1,101 public records · 117 security-fix timeline events.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 17
- High 91
- Medium 61
- Low 1
2026-07-21170 issues2026-10-18
Known exploited
View all known exploited- Critical9.8Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 99.98%Oct 14, 2025
- High8.8Microsoft Windows External Control of File Name or Path VulnerabilityPatch nowKEVEPSS 87.02%Jun 10, 2025
- High8.8Microsoft Windows SMB Client Improper Access Control VulnerabilityPatch nowKEVEPSS 82.70%Jun 10, 2025
- High7.5Microsoft Windows Scripting Engine Type Confusion VulnerabilityPatch nowKEVEPSS 27.04%May 13, 2025
- High8.8Microsoft Windows Shell Protection Mechanism Failure VulnerabilityPatch nowKEVEPSS 24.54%Feb 10, 2026
- High8.8Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityPatch nowKEVEPSS 15.85%Feb 10, 2026
- High7.8Microsoft Windows Out-of-Bounds Read VulnerabilityPatch nowKEVEPSS 12.09%Nov 14, 2023
- Medium5.5Microsoft Windows Information Disclosure VulnerabilityPatch nowKEVEPSS 7.46%Jan 13, 2026
Recently published
Browse catalog- Medium5.0FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZECheck if you run itEPSS 0.14%Oct 16, 2026
- Medium6.0Improper certificate validation in Cato Client tunnel handshakeCheck if you run itEPSS 0.08%Oct 15, 2026
- High7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.Check if you run itEPSS 0.44%Oct 14, 2026
- Medium4.3A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.Check if you run itEPSS 0.10%Oct 14, 2026
- Critical9.2Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL.Check if you run itEPSS 2.12%Oct 14, 2026
- Medium6.5Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.Check if you run itEPSS 0.55%Oct 13, 2026
- High7.8Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.24%Oct 13, 2026
- High7.8Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.29%Oct 13, 2026
- High7.8Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.34%Oct 13, 2026
- High7.8Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.31%Oct 13, 2026