59.529 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.529 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-88076 | HIGH 7.0 | microsoft windows_10_1607 Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85918 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85826 | HIGH 7.0 | microsoft windows_10_1607 Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85823 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85810 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85803 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85372 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-8528 | MED 4.3 | google chrome Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass Site Isolation via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-84020 | HIGH 7.0 | microsoft windows_10_21h2 Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83866 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83853 | HIGH 7.0 | microsoft windows_10_21h2 Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-63831 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cr | 0.3% | — |
| CVE-2026-5911 | MED 4.3 | google chrome Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2026-42406 | HIGH 8.7 | f5 big-ip_access_policy_manager A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reac | 0.3% | — |
| CVE-2026-3940 | MED 5.3 | google chrome Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2026-11664 | HIGH 8.8 | google chrome Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-11659 | CRIT 9.6 | google chrome Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-11638 | CRIT 9.6 | google chrome Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-11634 | CRIT 9.6 | google chrome Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-11630 | HIGH 8.8 | google chrome Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-108132 | HIGH 7.0 | microsoft windows_10_1607 Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-102208 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-102197 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-102195 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-102194 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | 0.3% | — |