59.223 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted descending |
|---|---|---|---|---|
| CVE-2026-77501 | HIGH 7.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | 1.2% | — |
| CVE-2026-77500 | HIGH 7.8 | microsoft windows_10_1607 Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-77499 | HIGH 7.5 | microsoft windows_10_1607 Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | 1.2% | — |
| CVE-2026-77498 | HIGH 7.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | 1.2% | — |
| CVE-2026-77495 | HIGH 8.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-77494 | HIGH 7.5 | microsoft windows_10_1607 Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | 1.2% | — |
| CVE-2026-77493 | CRIT 9.8 | microsoft windows_10_1607 Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-77492 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-77491 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-77490 | MED 6.1 | microsoft edge_chromium Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-77489 | HIGH 7.8 | microsoft windows_10_1607 Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-77488 | MED 5.5 | microsoft sql_server_2017 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-77487 | HIGH 8.8 | microsoft sql_server_2017 Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-77486 | HIGH 8.8 | microsoft sql_server_2017 Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-77485 | HIGH 7.0 | microsoft sql_server_2017 Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-77484 | HIGH 8.8 | microsoft sql_server_2019 Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-77483 | HIGH 8.8 | microsoft sql_server_2017 Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-77482 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-77481 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-77480 | HIGH 8.8 | microsoft sql_server_2017 Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-77180 | HIGH 8.3 | When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without san | 0.5% | — |
| CVE-2026-77105 | HIGH 8.8 | commvault commvault CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server. | 0.3% | — |
| CVE-2026-77104 | HIGH 7.5 | commvault commvault CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | 0.6% | — |
| CVE-2026-77103 | HIGH 7.5 | commvault commvault CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | 0.5% | — |
| CVE-2026-77102 | HIGH 7.5 | commvault commvault CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe. | 0.5% | — |