60.267 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.267 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-108133 | HIGH 7.8 | microsoft windows_server_2022 Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2026-108132 | HIGH 7.0 | microsoft windows_10_1607 Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-108130 | HIGH 7.8 | microsoft windows_11_24h2 Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2026-108129 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 1,0% | — |
| CVE-2026-108128 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 1,0% | — |
| CVE-2026-108127 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 1,0% | — |
| CVE-2026-108039 | HIGH 7.5 | apache cxf By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for e | 0,5% | — |
| CVE-2026-107938 | CRIT 9.1 | apache cxf In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was | 0,2% | — |
| CVE-2026-107937 | HIGH 7.5 | apache cxf In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physica | 0,6% | — |
| CVE-2026-106420 | MED 5.4 | google chrome Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium) | 0,2% | — |
| CVE-2026-106376 | MED 4.7 | google chrome Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0,2% | — |
| CVE-2026-106373 | HIGH 8.8 | google chrome Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 0,3% | — |
| CVE-2026-106355 | MED 5.3 | google chrome Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | 0,3% | — |
| CVE-2026-106340 | MED 4.6 | google chrome Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low) | 0,1% | — |
| CVE-2026-106284 | MED 4.7 | google chrome Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium secur | 0,2% | — |
| CVE-2026-106272 | MED 5.4 | google chrome UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network traffic. (Chromium security severity: Low) | 0,2% | — |
| CVE-2026-106258 | MED 4.7 | google chrome Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0,2% | — |
| CVE-2026-106236 | MED 5.4 | google chrome UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low) | 0,2% | — |
| CVE-2026-106215 | MED 4.7 | google chrome Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-106214 | MED 5.3 | google chrome Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High) | 0,2% | — |
| CVE-2026-106202 | MED 4.7 | google chrome Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-106186 | HIGH 8.6 | google chrome Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low) | 0,2% | — |
| CVE-2026-106183 | MED 5.9 | google chrome Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) | 0,3% | — |
| CVE-2026-106123 | MED 5.5 | vmware rabbitmq_java_client The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because | 0,2% | — |
| CVE-2026-106122 | HIGH 7.5 | vmware rabbitmq_java_client The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP short | 0,5% | — |