59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-67552 | HIGH 7.5 | apache qpid_proton-dotnet A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the i | 0.8% | — |
| CVE-2026-67551 | HIGH 7.5 | apache qpid_proton-dotnet pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fi | 0.8% | — |
| CVE-2026-67465 | HIGH 7.5 | apache qpid_proton-dotnet A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes | 0.8% | — |
| CVE-2026-67393 | MED 6.5 | microsoft sql_server_2017 Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67390 | MED 6.5 | microsoft sql_server_2017 Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67389 | MED 6.5 | microsoft sql_server_2022 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67388 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67386 | MED 6.5 | microsoft sql_server_2017 Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67385 | HIGH 8.8 | microsoft sql_server_2017 Use after free in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67384 | HIGH 8.8 | microsoft sql_server_2017 Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67383 | MED 6.5 | microsoft sql_server_2025 Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67381 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-67380 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67379 | HIGH 8.5 | microsoft sql_server_2019 Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-67378 | CRIT 9.0 | microsoft sql_server_2019 Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-67376 | HIGH 7.5 | microsoft sql_server_2017 Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network. | 1.2% | — |
| CVE-2026-67373 | HIGH 8.8 | microsoft sql_server_2025 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-67370 | HIGH 8.8 | microsoft sql_server_2017 Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | 1.0% | — |
| CVE-2026-67369 | MED 6.5 | microsoft sql_server_2025 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-67368 | HIGH 8.8 | microsoft sql_server_2017 Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network. | 1.0% | — |
| CVE-2026-67305 | HIGH 8.8 | freerdp freerdp FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP | 0.8% | — |
| CVE-2026-6730 | CRIT 9.8 | ibm concert IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. | 0.3% | — |
| CVE-2026-67260 | HIGH 7.3 | apache airflow Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value throug | 0.8% | — |
| CVE-2026-67211 | HIGH 7.5 | apache opennlp OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code.) Des | 0.7% | — |
| CVE-2026-6721 | CRIT 9.8 | ibm concert IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code ex | 1.4% | — |