59.967 CVE tracked
807 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.967 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted descending |
|---|---|---|---|---|
| CVE-2026-21902 | CRIT 9.8 | juniper junos_os_evolved An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly d | 18.5% | — |
| CVE-2026-21901 | MED 4.4 | juniper junos A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker setting or deactivating a specific SSH configuration parameter to create a Denial of Service (DoS | 0.2% | — |
| CVE-2026-21860 | MED 5.3 | palletsprojects werkzeug Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, | 0.5% | — |
| CVE-2026-21743 | HIGH 7.2 | fortinet fortiauthenticator A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local use | 0.4% | — |
| CVE-2026-21742 | MED 5.7 | fortinet fortisoar A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, Fort | 0.1% | — |
| CVE-2026-21741 | LOW 2.4 | fortinet fortinac-f An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator r | 0.2% | — |
| CVE-2026-21733 | HIGH 7.3 | imaginationtech ddk Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files. This is caused by improper handling of GPU memory reservation protections. | 0.1% | — |
| CVE-2026-21537 | HIGH 8.8 | microsoft defender_for_endpoint Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network. | 0.5% | — |
| CVE-2026-21536 | CRIT 9.8 | microsoft devices_pricing_program Microsoft Devices Pricing Program Remote Code Execution Vulnerability | 1.7% | — |
| CVE-2026-21535 | HIGH 8.2 | microsoft teams Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network. | 0.7% | — |
| CVE-2026-21532 | HIGH 8.2 | microsoft azure_functions Azure Function Information Disclosure Vulnerability | 0.9% | — |
| CVE-2026-21531 | CRIT 9.8 | microsoft azure_conversation_authoring_client_library Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network. | 2.6% | — |
| CVE-2026-21530 | MED 6.7 | microsoft windows_10_1607 Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-21529 | MED 5.7 | microsoft azure_hdinsight Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network. | 0.7% | — |
| CVE-2026-21528 | MED 6.5 | microsoft azure_iot_explorer Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. | 0.5% | — |
| CVE-2026-21527 | MED 6.5 | microsoft exchange_server User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 8.3% | — |
| CVE-2026-21524 | HIGH 7.4 | microsoft azure_data_explorer Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-21523 | HIGH 8.0 | microsoft visual_studio_code Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-21522 | MED 6.7 | microsoft confcom Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-21521 | HIGH 7.4 | microsoft 365_word_copilot Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-21520 | HIGH 7.5 | microsoft copilot_studio Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector | 1.5% | — |
| CVE-2026-21518 | HIGH 8.8 | microsoft visual_studio_code Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 1.5% | — |
| CVE-2026-21517 | MED 4.7 | microsoft windows_app Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-21516 | HIGH 8.8 | microsoft github_copilot Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-21515 | CRIT 9.9 | microsoft azure_iot_central Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. | 0.7% | — |