56.705 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.705 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più basso |
|---|---|---|---|---|
| CVE-2026-42891 | MED 6.5 | microsoft edge_chromium User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0,3% | — |
| CVE-2026-42838 | MED 5.4 | microsoft edge_chromium Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | 0,2% | — |
| CVE-2026-42837 | HIGH 7.8 | microsoft windows_10_1809 Out-of-bounds read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-42836 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally. | 0,2% | — |
| CVE-2026-42835 | HIGH 8.1 | microsoft teams Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. | 1,3% | — |
| CVE-2026-42834 | HIGH 7.8 | microsoft windows_admin_center Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 0,4% | — |
| CVE-2026-42833 | CRIT 9.1 | microsoft dynamics_365 Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | 0,7% | — |
| CVE-2026-42832 | HIGH 7.7 | microsoft excel Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. | 0,2% | — |
| CVE-2026-42831 | HIGH 7.8 | microsoft 365_copilot Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 0,4% | — |
| CVE-2026-42830 | MED 6.5 | microsoft azure_monitor_agent Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | 0,5% | — |
| CVE-2026-42829 | HIGH 7.8 | microsoft windows_11_24h2 Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally. | 0,3% | — |
| CVE-2026-42828 | HIGH 7.8 | microsoft windows_10_1809 Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-42827 | MED 6.5 | microsoft 365_copilot Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 0,5% | — |
| CVE-2026-42826 | CRIT 10.0 | microsoft azure_devops Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. | 0,8% | — |
| CVE-2026-42825 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. | 0,2% | — |
| CVE-2026-42824 | MED 6.5 | microsoft copilot Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 7,6% | — |
| CVE-2026-42823 | CRIT 9.9 | microsoft azure_logic_apps Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. | 0,6% | — |
| CVE-2026-42822 | CRIT 10.0 | microsoft azure_local Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network. | 0,5% | — |
| CVE-2026-42812 | CRIT 9.9 | apache polaris In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `write.metadata.path` is an optional table property that tells Polaris where to write those metadata fil | 0,4% | — |
| CVE-2026-42811 | CRIT 9.9 | apache polaris In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google | 0,4% | — |
| CVE-2026-42810 | CRIT 9.9 | apache polaris Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and `s3:prefix` conditions | 0,4% | — |
| CVE-2026-42809 | CRIT 9.9 | apache polaris Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data | 0,4% | — |
| CVE-2026-42797 | MED 4.9 | apache syncope Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User | 0,4% | — |
| CVE-2026-42782 | HIGH 7.2 | apache syncope Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class sta | 0,7% | — |
| CVE-2026-42781 | MED 6.5 | f5 big-ip_access_policy_manager When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Tec | 0,2% | — |