60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-88072 | HIGH 7.8 | microsoft windows_10_1809 Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83873 | HIGH 7.8 | microsoft windows_10_1607 Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70222 | HIGH 7.8 | microsoft windows_10_1607 Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70144 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-66325 | MED 6.1 | microsoft edge_chromium Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-62904 | MED 5.4 | microsoft edge_chromium Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | 0.4% | — |
| CVE-2026-57980 | MED 5.4 | microsoft edge_chromium Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. | 0.4% | — |
| CVE-2026-5286 | HIGH 8.8 | google chrome Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-5280 | HIGH 8.8 | google chrome Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-4675 | HIGH 8.8 | google chrome Heap buffer overflow in WebGL in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-3915 | HIGH 8.8 | google chrome Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-20334 | HIGH 8.4 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond | 0.4% | — |
| CVE-2026-0250 | HIGH 8.1 | paloaltonetworks globalprotect A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the | 0.4% | — |
| CVE-2025-59290 | HIGH 7.8 | microsoft windows_10_21h2 Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-58716 | HIGH 8.8 | microsoft windows_10_1507 Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-58715 | HIGH 8.8 | microsoft windows_10_1507 Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-47148 | MED 6.5 | f5 big-ip_access_policy_manager When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource util | 0.4% | — |
| CVE-2025-21947 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_r | 0.4% | — |
| CVE-2025-21890 | HIGH 8.2 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: idpf: fix checksums set in idpf_rx_rsc() idpf_rx_rsc() uses skb_transport_offset(skb) while the transport header is not set yet. This triggers the following warning for CONFIG_DEBUG_NET=y b | 0.4% | — |
| CVE-2025-21805 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Add missing deinit() call A warning is triggered when repeatedly connecting and disconnecting the rnbd: list_add corruption. prev->next should be next (ffff88800b13e480), but was | 0.4% | — |
| CVE-2024-55909 | MED 6.5 | ibm concert IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption. | 0.4% | — |
| CVE-2024-32124 | MED 4.3 | fortinet fortiisolator An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attacker to alter logs via a crafted HTTP request. | 0.4% | — |
| CVE-2024-20386 | MED 4.8 | cisco firepower_management_center A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected devic | 0.4% | — |
| CVE-2023-32162 | HIGH 7.8 | wacom driver Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the abili | 0.4% | — |
| CVE-2022-49768 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: 9p: trans_fd/p9_conn_cancel: drop client lock earlier syzbot reported a double-lock here and we no longer need this lock after requests have been moved off to local list: just drop the lock | 0.4% | — |