57.298 CVE tracked
779 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.298 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2026-24300 | CRIT 9.8 | microsoft azure_front_door Azure Front Door Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2026-24299 | MED 5.3 | microsoft 365_copilot Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-24297 | MED 6.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a security feature over a network. | 0.3% | — |
| CVE-2026-24296 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-24295 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-24294 | HIGH 7.8 | microsoft windows_10_1607 Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. | 4.7% | — |
| CVE-2026-24293 | HIGH 7.8 | microsoft windows_10_21h2 Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-24292 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-24291 | HIGH 7.8 | microsoft windows_10_1607 Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally. | 3.2% | — |
| CVE-2026-24290 | HIGH 7.8 | microsoft windows_10_1809 Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-24289 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 4.5% | — |
| CVE-2026-24288 | MED 6.8 | microsoft windows_10_21h2 Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack. | 0.4% | — |
| CVE-2026-24287 | HIGH 7.8 | microsoft windows_10_1809 External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-24285 | HIGH 7.0 | microsoft 365_copilot Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-24283 | HIGH 8.8 | microsoft windows_11_24h2 Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-24282 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-24281 | HIGH 7.4 | apache zookeeper Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It | 0.6% | — |
| CVE-2026-24266 | MED 5.9 | nvidia triton_inference_server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service. | 0.7% | — |
| CVE-2026-24264 | HIGH 7.5 | nvidia triton_inference_server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service. | 0.7% | — |
| CVE-2026-24255 | HIGH 7.5 | nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vuln | 0.4% | — |
| CVE-2026-24254 | CRIT 9.8 | nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial | 0.5% | — |
| CVE-2026-24253 | HIGH 8.2 | nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering. | 0.4% | — |
| CVE-2026-24252 | HIGH 7.8 | nvidia nemo NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure. | 0.7% | — |
| CVE-2026-24251 | HIGH 7.8 | nvidia nemo_megatron_bridge NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a | 0.4% | — |
| CVE-2026-24250 | HIGH 7.8 | nvidia nemo_megatron_bridge NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information di | 0.4% | — |