60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-85910 | MED 5.5 | microsoft windows_11_24h2 Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-85909 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83870 | MED 5.5 | microsoft windows_11_24h2 Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83849 | MED 5.5 | microsoft windows_10_21h2 Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83794 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-70270 | MED 5.5 | microsoft windows_10_1607 Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70173 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-70141 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-49157 | HIGH 8.8 | apache activemq Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia oper | 0.4% | — |
| CVE-2026-47292 | HIGH 7.8 | microsoft visual_studio_code Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-32171 | HIGH 8.8 | microsoft azure_logic_apps Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2026-31906 | MED 6.1 | apache ofbiz Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. | 0.4% | — |
| CVE-2026-26179 | HIGH 7.8 | microsoft windows_11_23h2 Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-22922 | MED 6.5 | apache airflow Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow | 0.4% | — |
| CVE-2026-103567 | MED 5.5 | microsoft windows_10_1809 Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-60718 | HIGH 7.8 | microsoft windows_11_24h2 Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-59292 | HIGH 8.2 | microsoft azure_compute_gallery External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-59291 | HIGH 8.2 | microsoft azure_compute_gallery External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-24431 | MED 5.5 | adobe acrobat Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR | 0.4% | — |
| CVE-2024-41164 | MED 5.9 | f5 big-ip_access_policy_manager When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support ( | 0.4% | — |
| CVE-2024-39388 | HIGH 7.8 | adobe substance_3d_stager Substance3D - Stager versions 3.0.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a m | 0.4% | — |
| CVE-2024-38832 | HIGH 7.1 | vmware aria_operations VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | 0.4% | — |
| CVE-2022-4696 | HIGH 7.8 | linux linux_kernel There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter | 0.4% | — |
| CVE-2022-4378 | HIGH 7.8 | linux linux_kernel A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. | 0.4% | — |
| CVE-2021-3146 | HIGH 7.8 | dolby audio_x2 The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges. | 0.4% | — |