58.912 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.912 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-88183 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | — | — |
| CVE-2026-88178 | CRIT 9.8 | microsoft 365_apps Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | — | — |
| CVE-2026-88175 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88172 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88169 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88167 | MED 6.5 | microsoft 365_apps Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88166 | HIGH 8.8 | microsoft sharepoint_server Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-88163 | HIGH 8.8 | microsoft sharepoint_server Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-88156 | CRIT 9.8 | microsoft 365_apps Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | — | — |
| CVE-2026-88155 | HIGH 8.8 | microsoft sharepoint_server Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-88154 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88153 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88151 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-88150 | HIGH 8.8 | microsoft 365_apps Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-88145 | HIGH 8.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-88144 | HIGH 8.8 | microsoft 365_apps Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | — | — |
| CVE-2026-88131 | CRIT 9.8 | microsoft dataverse Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. | — | — |
| CVE-2026-88109 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | — | — |
| CVE-2026-88097 | HIGH 8.1 | microsoft edge_chromium Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-87976 | HIGH 8.1 | apache nifi Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem pa | 0.8% | — |
| CVE-2026-87830 | CRIT 9.1 | apache wss4j In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signatu | 0.2% | — |
| CVE-2026-87701 | CRIT 9.6 | microsoft azure_cosmos_db Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-87654 | CRIT 9.6 | google chrome Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0.5% | — |
| CVE-2026-87653 | MED 5.4 | google chrome UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2026-87648 | HIGH 8.3 | google chrome Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Med | 0.4% | — |