57.075 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.075 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-32327 | CRIT 9.1 | apache apr-util A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this | 0.5% | — |
| CVE-2026-32310 | MED 4.1 | cryptomator cryptomator Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity is verified, and the masterkeyfile loader uses the unverified keyId as a filesystem path. The loader | 0.2% | — |
| CVE-2026-32228 | HIGH 7.5 | apache airflow UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue. | 0.4% | — |
| CVE-2026-32227 | CRIT 9.8 | apache ranger SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. | 0.4% | — |
| CVE-2026-32226 | MED 5.9 | microsoft .net_framework Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network. | 0.5% | — |
| CVE-2026-32225 | HIGH 8.8 | microsoft windows_10_1607 Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | 1.2% | — |
| CVE-2026-32224 | HIGH 7.0 | microsoft windows_11_26h1 Use after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-32223 | MED 6.8 | microsoft windows_11_24h2 Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 0.5% | — |
| CVE-2026-32222 | HIGH 7.8 | microsoft windows_11_24h2 Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-32221 | HIGH 8.4 | microsoft windows_11_24h2 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-32220 | MED 4.4 | microsoft windows_11_24h2 Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-32219 | HIGH 7.0 | microsoft windows_11_24h2 Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-32218 | MED 5.5 | microsoft windows_10_21h2 Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-32217 | MED 5.5 | microsoft windows_10_1607 Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-32216 | MED 5.5 | microsoft windows_11_26h1 Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally. | 0.4% | — |
| CVE-2026-32215 | MED 5.5 | microsoft windows_10_1809 Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-32214 | MED 5.5 | microsoft windows_10_1607 Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. | 0.2% | — |
| CVE-2026-32213 | CRIT 10.0 | microsoft azure_ai_foundry Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-32212 | MED 5.5 | microsoft windows_10_1607 Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-32211 | CRIT 9.1 | microsoft azure_web_apps Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network. | 0.8% | — |
| CVE-2026-32210 | CRIT 9.3 | microsoft dynamics_365 Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-32209 | MED 4.4 | microsoft windows_10_1607 Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. | 0.2% | — |
| CVE-2026-32208 | HIGH 8.8 | microsoft edge_chromium Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network. | 0.5% | — |
| CVE-2026-32207 | HIGH 8.8 | microsoft azure_machine_learning Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-32204 | HIGH 7.8 | microsoft azure_monitor_agent External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | 0.3% | — |