60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.267 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted descending |
|---|---|---|---|---|
| CVE-2026-102860 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-102859 | MED 4.6 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-102858 | HIGH 8.8 | microsoft microsoft_365 Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-102857 | HIGH 8.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-102856 | HIGH 8.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-102855 | HIGH 8.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-102850 | HIGH 8.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-102849 | HIGH 8.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-102497 | HIGH 7.5 | apache xmlschema The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of serv | 0.5% | — |
| CVE-2026-102496 | HIGH 7.5 | apache xmlschema Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2. | 0.5% | — |
| CVE-2026-102495 | HIGH 7.5 | apache xmlschema Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this | 0.5% | — |
| CVE-2026-102317 | HIGH 8.6 | google chrome Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | 0.1% | — |
| CVE-2026-102315 | LOW 3.4 | google chrome Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-102313 | MED 4.7 | google chrome Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-102231 | HIGH 7.7 | microsoft visual_studio_code Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-102227 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-102225 | HIGH 8.8 | microsoft windows_10_1607 Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-102221 | MED 4.4 | microsoft windows_10_1607 No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-102220 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102218 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102217 | HIGH 8.8 | microsoft windows_10_1607 Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. | 1.3% | — |
| CVE-2026-102216 | HIGH 7.8 | microsoft windows_10_1607 Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102215 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102214 | HIGH 8.8 | microsoft windows_10_1607 Use after free in Windows Hyper-V allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-102211 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 0.2% | — |