Vendor, status, exposure, timing, and source link — all in one row.
Operations view
Microsoft
Microsoft Internet Explorer Use-After-Free Vulnerability
critical
activeCISA KEVCVE-2010-0806
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
May 19, 2026, 7:00 PM
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 88.2% EPSS.
Microsoft DirectX NULL Byte Overwrite Vulnerability
critical
activeCISA KEVCVE-2009-1537
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
May 19, 2026, 7:00 PM
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 74.1% EPSS.
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
May 19, 2026, 7:00 PM
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 93.6% EPSS.
Microsoft Internet Explorer Use-After-Free Vulnerability
critical
activeCISA KEVCVE-2010-0249
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
May 19, 2026, 7:00 PM
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 88.6% EPSS.
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
critical
activeCISA KEVCVE-2009-3459
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
May 19, 2026, 7:00 PM
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 90.5% EPSS.
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-04-30.
Apr 15, 2026, 7:00 PM
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 75.8% EPSS.
Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
criticalCVE-2010-0806
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 88.2% EPSS.
Microsoft DirectX NULL Byte Overwrite Vulnerability
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
criticalCVE-2009-1537
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 74.1% EPSS.
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
criticalCVE-2008-4250
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 93.6% EPSS.
Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
criticalCVE-2010-0249
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 88.6% EPSS.
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.
criticalCVE-2009-3459
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 90.5% EPSS.
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-04-30.
criticalCVE-2026-34197
Critical
Priority score blends severity, KEV, recency, source signal, and EPSS where available. 75.8% EPSS.
Quick answers to the questions we hear most often about Threat Radar.
What is the ITECS MSP Threat Radar?
It is a self-updating resource hub that combines official threat feeds, vendor advisories, and live service incidents into one operational watch page for Dallas-area business teams.
Which sources does Threat Radar track?
The feed is built from official sources including CISA Known Exploited Vulnerabilities, the National Vulnerability Database, Microsoft Security Update Guide, Cisco advisories, Fortinet PSIRT, Cloudflare Status, Vercel Status for Next.js hosting operations, and Google Workspace Status.
How should businesses use Threat Radar?
Use it to spot active issues faster, validate whether they affect Microsoft 365, Cisco, Fortinet, or core SaaS dependencies, and then move into assessment, remediation, or managed support planning.
Can ITECS help after an item appears on Threat Radar?
Yes. ITECS can help translate the alert into patch prioritization, compensating controls, vendor-specific action plans, and broader managed cybersecurity or managed IT follow-through.
