59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-1061 | MED 6.3 | nvidia virtual_gpu_manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to continue using a previously validated resource that has since changed, which may lead to denial of service or information disclosure. This a | 0.2% | — |
| CVE-2026-96937 | HIGH 7.0 | microsoft windows_10_21h2 Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-96322 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-96307 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88103 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88098 | HIGH 7.0 | microsoft windows_10_1607 Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-87715 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-85914 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-85365 | HIGH 7.0 | microsoft windows_10_1607 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-7962 | MED 5.4 | google chrome Insufficient policy enforcement in DirectSockets in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via a crafted Chrome Extension. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-7953 | MED 6.1 | google chrome Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-7950 | MED 5.4 | google chrome Out of bounds read and write in GFX in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via malicious network traffic. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-7942 | MED 4.3 | google chrome Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-68745 | HIGH 8.1 | apache cloudstack Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url o | 0.2% | — |
| CVE-2026-65117 | MED 5.0 | nvidia infra_controller NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure. | 0.2% | — |
| CVE-2026-46316 | CRIT 9.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's | 0.2% | — |
| CVE-2026-20022 | MED 6.1 | cisco adaptive_security_appliance_software A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalizati | 0.2% | — |
| CVE-2026-17908 | MED 5.8 | google chrome Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security sev | 0.2% | — |
| CVE-2026-13034 | MED 4.7 | google chrome Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-13021 | MED 4.3 | google chrome Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2025-9479 | MED 4.3 | google chrome Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2025-46266 | MED 4.3 | teamviewer digital_employee_experience A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to coerce the service into transmitting data to an arbitrary internal IP address, potentially l | 0.2% | — |
| CVE-2025-38428 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - check record size in ims_pcu_flash_firmware() The "len" variable comes from the firmware and we generally do trust firmware, but it's always better to double check. If the | 0.2% | — |
| CVE-2025-38424 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The cra | 0.2% | — |
| CVE-2025-38389 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: <4> [239.3 | 0.2% | — |