60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-81992 | HIGH 7.8 | adobe acrobat Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 0.3% | — |
| CVE-2026-77503 | HIGH 8.4 | microsoft windows_10_1607 Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-75649 | HIGH 7.8 | adobe bridge Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 0.3% | — |
| CVE-2026-7353 | HIGH 8.3 | google chrome Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-71399 | HIGH 7.8 | adobe xd Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interacti | 0.3% | — |
| CVE-2026-70130 | HIGH 8.4 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-69680 | HIGH 8.1 | microsoft windows_10_1607 Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network. | 0.3% | — |
| CVE-2026-59657 | HIGH 7.5 | apache cloudstack Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to ver | 0.3% | — |
| CVE-2026-54992 | HIGH 8.4 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-49184 | HIGH 8.4 | microsoft windows_10_1607 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-48373 | HIGH 7.8 | adobe acrobat Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 0.3% | — |
| CVE-2026-48339 | HIGH 7.8 | adobe bridge Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 0.3% | — |
| CVE-2026-46316 | CRIT 9.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's | 0.3% | — |
| CVE-2026-34626 | MED 6.3 | adobe acrobat Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary file system read in the conte | 0.3% | — |
| CVE-2026-32967 | CRIT 9.1 | apache dolphinscheduler Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue. | 0.3% | — |
| CVE-2026-30798 | HIGH 7.5 | rustdesk rustdesk Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protoc | 0.3% | — |
| CVE-2026-11651 | CRIT 9.6 | google chrome Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-0280 | HIGH 7.2 | paloaltonetworks pan-os An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cl | 0.3% | — |
| CVE-2025-59253 | MED 5.5 | microsoft windows_10_1507 Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally. | 0.3% | — |
| CVE-2025-55690 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-54290 | MED 5.3 | canonical lxd Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints. | 0.3% | — |
| CVE-2025-3937 | HIGH 7.7 | tridium niagara Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, | 0.3% | — |
| CVE-2025-25252 | MED 4.8 | fortinet fortios An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and | 0.3% | — |
| CVE-2025-20214 | MED 4.3 | cisco ios_xe A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability exists because a sub | 0.3% | — |
| CVE-2024-50125 | HIGH 8.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sc | 0.3% | — |