16 spills in 12 months for Windows
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- highpatchedexploited Microsoft Windows Command Injection Vulnerability Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-10-13 (federal deadline 2026-10-16).
- highpatchedexploited Microsoft Windows Link Following Vulnerability Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. Can be chained with CVE-2026-85880. Added to CISA KEV on 2026-09-08 (federal deadline 2026-09-22).
- highpatchedexploited Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-08-11 (federal deadline 2026-08-25).
- highpatchedexploited Microsoft Windows Buffer Overflow Vulnerability Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. Added to CISA KEV on 2026-05-20 (federal deadline 2026-06-03).
- highpatchedexploited Microsoft Defender Link Following Vulnerability Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. Can be chained with CVE-2026-45498. Added to CISA KEV on 2026-05-20 (federal deadline 2026-06-03).
- highpatchedexploited Microsoft Windows Protection Mechanism Failure Vulnerability Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-28 (federal deadline 2026-05-12).
- criticalpatchedexploited Microsoft Defender Insufficient Granularity of Access Control Vulnerability Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Added to CISA KEV on 2026-04-22 (federal deadline 2026-05-06).
- criticalpatchedexploited Microsoft Windows Link Following Vulnerability Microsoft Windows contains a link following vulnerability that allows for privilege escalation Can be chained with CVE-2023-36424. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27).
- highpatchedexploited Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. Added to CISA KEV on 2026-02-17 (federal deadline 2026-03-10).
- highpatchedexploited Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability Microsoft Windows Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. Can be chained with CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519. Added to CISA KEV on 2026-02-10 (federal deadline 2026-03-03).
- highpatchedexploited React Native Community CLI OS Command Injection Vulnerability React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05 (federal deadline 2026-02-26).
- highpatchedexploited Prettier eslint-config-prettier Embedded Malicious Code Vulnerability Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).
- highpatchedexploited Microsoft Windows Information Disclosure Vulnerability Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. Added to CISA KEV on 2026-01-13 (federal deadline 2026-02-03).
- highpatchedexploited Microsoft Windows Use After Free Vulnerability Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-12-09 (federal deadline 2025-12-30).
- highpatchedexploited Microsoft Windows Race Condition Vulnerability Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. Added to CISA KEV on 2025-11-12 (federal deadline 2025-12-03).
Follow Windows
RSS: /feed.xml?stack=windows. JSON: /incidents.json?stack=windows. Or add it to your usual for delivery.