57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-68840 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-68837 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-68825 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-68824 | HIGH 7.0 | microsoft windows_10_21h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-68820 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 6.2% | |
| CVE-2026-6851 | HIGH 7.0 | bitdefender internet_security An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race condit | 0.1% | — |
| CVE-2026-65788 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 1.7% | — |
| CVE-2026-65783 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65782 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65781 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65780 | HIGH 7.0 | microsoft windows_11_24h2 Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65779 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65778 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65776 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65678 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-65082 | HIGH 7.0 | nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of servi | 0.2% | — |
| CVE-2026-64420 | HIGH 7.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was al | 0.1% | — |
| CVE-2026-64413 | HIGH 7.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possibl | 0.1% | — |
| CVE-2026-64315 | HIGH 7.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel() for dumping sensitive key material in *_setkey() to avoid leaking secrets at runtime when CONFIG_DYN | 0.1% | — |
| CVE-2026-64283 | HIGH 7.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guest_memfd file, treat the offset and size as unsigned values to fix a bug where the sum o | 0.1% | — |
| CVE-2026-64222 | HIGH 7.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, | 0.1% | — |
| CVE-2026-64219 | HIGH 7.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack | 0.1% | — |
| CVE-2026-62908 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-62897 | HIGH 7.0 | microsoft .net Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-62892 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally. | 0.2% | — |