60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-83582 | MED 4.7 | microsoft windows_10_1607 Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-70274 | HIGH 7.8 | microsoft windows_11_23h2 Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70238 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70218 | HIGH 7.8 | microsoft windows_11_24h2 Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70177 | HIGH 7.8 | microsoft windows_10_1607 Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70077 | MED 4.7 | microsoft windows_10_1607 Use after free in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-70063 | MED 4.7 | microsoft windows_10_1607 Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-70051 | HIGH 7.8 | microsoft windows_10_1809 Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-69713 | MED 4.4 | microsoft windows_10_1607 Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-69506 | MED 4.7 | microsoft windows_10_1607 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-64068 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into s | 0.4% | — |
| CVE-2026-5289 | CRIT 9.6 | google chrome Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-47631 | HIGH 8.1 | microsoft exchange_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-45658 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-43345 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define | 0.4% | — |
| CVE-2026-41705 | HIGH 8.6 | vmware spring_ai Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 | 0.4% | — |
| CVE-2026-33803 | MED 6.5 | juniper junos_os_evolved An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due t | 0.4% | — |
| CVE-2026-32084 | MED 5.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-14108 | HIGH 8.8 | google chrome Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low) | 0.4% | — |
| CVE-2026-108133 | HIGH 7.8 | microsoft windows_server_2022 Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-105004 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-103553 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102227 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-67706 | MED 5.6 | esri arcgis_server ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture en | 0.4% | — |
| CVE-2025-55697 | HIGH 7.8 | microsoft windows_server_2022_23h2 Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally. | 0.4% | — |