59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-69282 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-69281 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows License Manager allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69280 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-6928 | CRIT 9.8 | ibm concert IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code. | 0.4% | — |
| CVE-2026-69279 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69278 | HIGH 7.8 | microsoft visual_studio_code Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-69277 | HIGH 7.8 | microsoft windows_10_1607 Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69276 | CRIT 9.8 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-69275 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69274 | HIGH 7.1 | microsoft windows_10_1607 Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-69273 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-69272 | HIGH 7.1 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-69271 | HIGH 8.0 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-69270 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69269 | HIGH 7.8 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69268 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-69267 | MED 6.5 | microsoft windows_10_1809 Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-69266 | HIGH 8.8 | microsoft windows_10_1607 Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-69265 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-6925 | MED 5.3 | ibm concert IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system. | 0.3% | — |
| CVE-2026-69223 | CRIT 9.1 | apache allura Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. | 0.8% | — |
| CVE-2026-69220 | ND | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call Val | 0.7% | — |
| CVE-2026-69219 | ND | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength | 0.7% | — |
| CVE-2026-6921 | HIGH 8.3 | google chrome Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-6920 | CRIT 9.6 | google chrome Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |