58.127 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.127 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-72943 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-72928 | HIGH 7.5 | microsoft windows_server_2025 Use after free in Windows DNS allows an authorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-68898 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network. | 0.6% | — |
| CVE-2026-67379 | HIGH 8.5 | microsoft sql_server_2019 Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-55002 | HIGH 8.8 | microsoft sql_server_2016 External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-52986 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper th | 0.6% | — |
| CVE-2026-32183 | HIGH 7.8 | microsoft windows_10_1607 Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2026-0391 | MED 6.5 | microsoft edge_chromium User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-58903 | LOW 2.7 | fortinet fortios An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request. | 0.6% | — |
| CVE-2025-55244 | CRIT 9.0 | microsoft azure_ai_bot_service Azure Bot Service Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2025-21275 | HIGH 7.8 | microsoft windows_10_21h2 Windows App Package Installer Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-43571 | MED 5.6 | microsoft windows_11_24h2 Sudo for Windows Spoofing Vulnerability | 0.6% | — |
| CVE-2024-35870 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs | 0.6% | — |
| CVE-2022-49003 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvme_ns_head list Walking the nvme_ns_head siblings list is protected by the head's srcu in nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths(). Remo | 0.6% | — |
| CVE-2022-38017 | MED 6.8 | microsoft storsimple_8010_firmware StorSimple 8000 Series Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-77481 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-76424 | HIGH 7.2 | A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulne | 0.6% | — |
| CVE-2026-73012 | HIGH 8.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-67384 | HIGH 8.8 | microsoft sql_server_2017 Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-67373 | HIGH 8.8 | microsoft sql_server_2025 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-62882 | MED 4.3 | microsoft 365_apps Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-61485 | HIGH 7.5 | apache lucy ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend | 0.6% | — |
| CVE-2024-56640 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making | 0.6% | — |
| CVE-2024-5160 | HIGH 8.8 | fedoraproject fedora Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) | 0.6% | — |
| CVE-2024-49988 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: add refcnt to ksmbd_conn struct When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd | 0.6% | — |