59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-68060 | HIGH 7.5 | apache qpid_broker-j A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fix | 0.8% | — |
| CVE-2026-6794 | HIGH 7.8 | ibm concert IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process. | 0.1% | — |
| CVE-2026-67648 | MED 6.5 | microsoft sql_server_2017 Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67645 | MED 6.5 | microsoft sql_server_2017 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67643 | CRIT 9.8 | microsoft sql_server_2022 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-67642 | HIGH 8.8 | microsoft sql_server_2025 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67641 | MED 6.5 | microsoft sql_server_2022 Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network. | 1.1% | — |
| CVE-2026-67639 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67638 | HIGH 8.8 | microsoft sql_server_2025 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67636 | CRIT 9.0 | microsoft sql_server_2019 Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-67633 | MED 6.5 | microsoft sql_server_2017 Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. | 1.1% | — |
| CVE-2026-67631 | CRIT 9.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-67630 | MED 6.5 | microsoft sql_server_2017 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67629 | MED 6.5 | microsoft sql_server_2017 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67624 | MED 6.5 | microsoft sql_server_2019 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67593 | CRIT 9.1 | apache artemis A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2. | 0.9% | — |
| CVE-2026-67592 | HIGH 7.5 | apache qpid_protonj2 It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are | 0.7% | — |
| CVE-2026-67591 | MED 6.5 | apache qpid_protonj2 An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue. | 0.7% | — |
| CVE-2026-67590 | HIGH 7.5 | apache qpid_protonj2 A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue | 0.8% | — |
| CVE-2026-67589 | HIGH 7.5 | apache qpid_protonj2 A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes | 0.8% | — |
| CVE-2026-67588 | HIGH 7.5 | apache qpid_protonj2 A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the | 0.8% | — |
| CVE-2026-67587 | HIGH 8.8 | apache airflow Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserializati | 0.6% | — |
| CVE-2026-67555 | MED 6.5 | apache qpid_proton-dotnet It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users | 0.7% | — |
| CVE-2026-67554 | MED 6.5 | apache qpid_proton-dotnet An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to | 0.7% | — |
| CVE-2026-67553 | MED 6.5 | apache qpid_proton-dotnet An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue. | 0.7% | — |