Public security advisories
Current vulnerabilities, known exploitation, Microsoft security updates, and practical guidance from Griffin Technology Partners.
Primary sources
Microsoft Security Response Center
CISA Known Exploited Vulnerabilities
Vulnerability intelligence
Last collection: October 21, 2026
Six-hour refresh · Public-source information only
Showing the most recent saved intelligence. One or more sources are awaiting a successful refresh; source dates are listed below.
7,902 bulletins · Page 189 of 330
JSON feedImproper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Affected: Microsoft 365 Apps for Enterprise for 32-bit Systems · Microsoft 365 Apps for Enterprise for 64-bit Systems · +11 more
Updated
Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.
Affected: Windows 10 Version 1809 for 32-bit Systems · Windows 10 Version 1809 for x64-based Systems · +6 more
Updated
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
Affected: Server
Added to CISA KEV
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
Affected: Server
Added to CISA KEV
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +28 more
Updated
Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
Affected: Windows 10 Version 1809 for 32-bit Systems · Windows 10 Version 1809 for x64-based Systems · +17 more
Updated
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
Affected: Power BI Report Server
Updated
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
Affected: Windows 11 Version 24H2 for ARM64-based Systems · Windows 11 Version 24H2 for x64-based Systems · +4 more
Updated
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
Affected: Power BI Report Server
Updated
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Affected: PowerShell 7.4 · PowerShell 7.5 · +1 more
Updated
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Affected: MLflow
Added to CISA KEV
Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
Affected: Azure Connected Machine Agent
Updated
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +25 more
Updated
Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.
Affected: Fabric Data Warehouse
Updated
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
Affected: Internet Key Exchange (IKE) Service Extensions
Added to CISA KEV
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Affected: Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server 2019 · +1 more
Updated
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Affected: VMware vCenter
Added to CISA KEV
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Affected: macOS
Added to CISA KEV
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +25 more
Updated
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1809 for 32-bit Systems · Windows 10 Version 1809 for x64-based Systems · +20 more
Updated
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
Affected: .NET 10.0 installed on Windows · .NET 8.0 installed on Windows · +48 more
Updated
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Affected: Microsoft 365 Apps for Enterprise for 32-bit Systems · Microsoft 365 Apps for Enterprise for 64-bit Systems · +11 more
Updated
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Affected: Microsoft 365 Apps for Enterprise for 32-bit Systems · Microsoft 365 Apps for Enterprise for 64-bit Systems · +11 more
Updated
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Affected: Microsoft 365 Apps for Enterprise for 32-bit Systems · Microsoft 365 Apps for Enterprise for 64-bit Systems · +9 more
Updated
The collection starts with 90 days of Microsoft updates and CISA additions, plus older Microsoft vulnerabilities still listed by CISA. Older entries do not imply that a product remains supported. Counts describe this collection, not every vulnerability or any customer environment.
Last successful check: October 13, 2026
Last successful check: October 21, 2026
Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.
Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.
