CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 07:30 UTC )
This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,443 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product microsoft:windows_server_2008_r2 . Show all products
17 CVEs, showing 1 to 17
CVE Severity Title Published CVE-2018-8174 Known exploited
High 7.5 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7,… Assigned by microsoft
May 9, 2018 CVE-2018-8120 Known exploited
High 7.0 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows… Assigned by microsoft
May 9, 2018 CVE-2018-8440 Known exploited
High 7.8 An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Win… Assigned by microsoft
Sep 13, 2018 CVE-2018-8453 Known exploited
High 7.8 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows… Assigned by microsoft
Oct 10, 2018 CVE-2018-8589 Known exploited
High 7.8 An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Window… Assigned by microsoft
Nov 14, 2018 CVE-2018-8639 Known exploited
High 8.4 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows… Assigned by microsoft
Dec 12, 2018 CVE-2018-8611 Known exploited
High 7.8 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, W… Assigned by microsoft
Dec 12, 2018 CVE-2020-1464 Known exploited
High 7.8 Windows Spoofing Vulnerability Assigned by microsoft
Aug 17, 2020 CVE-2020-1472 Known exploited
Medium 5.5 Netlogon Elevation of Privilege Vulnerability Assigned by microsoft
Aug 17, 2020 CVE-2020-17087 Known exploited
High 7.8 Windows Kernel Local Elevation of Privilege Vulnerability Assigned by microsoft
Nov 11, 2020 CVE-2021-1675 Known exploited
High 7.8 Windows Print Spooler Remote Code Execution Vulnerability Assigned by microsoft
Jun 8, 2021 CVE-2021-31201 Known exploited
Medium 5.2 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Assigned by microsoft
Jun 8, 2021 CVE-2021-31199 Known exploited
Medium 5.2 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Assigned by microsoft
Jun 8, 2021 CVE-2021-31956 Known exploited
High 7.8 Windows NTFS Elevation of Privilege Vulnerability Assigned by microsoft
Jun 8, 2021 CVE-2021-33742 Known exploited
High 7.5 Windows MSHTML Platform Remote Code Execution Vulnerability Assigned by microsoft
Jun 8, 2021 CVE-2021-40449 Known exploited
High 7.8 Win32k Elevation of Privilege Vulnerability Assigned by microsoft
Oct 13, 2021 CVE-2021-43226 Known exploited
High 7.8 Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft
Dec 15, 2021
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
