59.222 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.222 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-78457 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-78456 | HIGH 8.8 | microsoft sql_server_2022 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-78455 | MED 4.3 | microsoft windows_10_1607 Out-of-bounds read in Xbox allows an unauthorized attacker to disclose information with a physical attack. | 0.5% | — |
| CVE-2026-78454 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-78453 | MED 6.5 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-78452 | MED 4.6 | microsoft windows_10_1809 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information with a physical attack. | 0.5% | — |
| CVE-2026-78451 | MED 6.8 | microsoft windows_10_1809 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack. | 0.4% | — |
| CVE-2026-78450 | HIGH 8.1 | microsoft windows_10_1809 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-78449 | HIGH 8.1 | microsoft windows_10_1607 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-78448 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-78447 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-78446 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-78445 | CRIT 9.8 | microsoft windows_server_2012 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-78444 | HIGH 8.1 | microsoft windows_10_1809 Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-78442 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-78441 | MED 6.5 | microsoft sql_server_2017 Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-78329 | CRIT 9.8 | apache camel Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the | 0.7% | — |
| CVE-2026-78254 | HIGH 7.4 | apache ant The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker' | 0.5% | — |
| CVE-2026-78222 | HIGH 7.5 | A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: | 0.6% | — |
| CVE-2026-77911 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-77909 | HIGH 7.7 | microsoft azure_cyclecloud Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-77908 | HIGH 8.8 | microsoft dynamics_365 Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-77907 | HIGH 8.8 | microsoft visual_studio_2026 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-77906 | HIGH 8.8 | microsoft visual_studio_2026 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-77905 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | 0.3% | — |