59.967 CVE tracked
807 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.967 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-52993 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a poi | 0.4% | — |
| CVE-2026-50690 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50455 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50437 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50401 | MED 5.5 | microsoft windows_10_1809 Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50383 | MED 6.1 | microsoft windows_10_1809 Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50381 | MED 5.5 | microsoft windows_10_21h2 Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50341 | MED 5.5 | microsoft windows_10_1607 Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50300 | MED 5.5 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-49801 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-48566 | MED 5.5 | microsoft windows_11_24h2 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-45634 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-45604 | MED 5.5 | microsoft windows_11_23h2 Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-44814 | MED 5.5 | microsoft windows_11_26h1 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-42969 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-42968 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-41954 | MED 4.9 | f5 big-ip_access_policy_manager Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software v | 0.4% | — |
| CVE-2026-40422 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-35419 | MED 5.5 | microsoft windows_11_24h2 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-20009 | MED 5.3 | cisco adaptive_security_appliance_software A vulnerability in the implementation of the proprietary SSH stack with SSH key-based authentication in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to log in to a Cisco Secure Firewall ASA de | 0.4% | — |
| CVE-2025-62570 | HIGH 7.1 | microsoft windows_11_24h2 Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-21159 | HIGH 7.8 | adobe illustrator Illustrator versions 29.1, 28.7.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mal | 0.4% | — |
| CVE-2024-4454 | HIGH 7.8 | withsecure client_security WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part | 0.4% | — |
| CVE-2024-39954 | MED 6.3 | apache eventmesh CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version | 0.4% | — |
| CVE-2023-20856 | HIGH 8.8 | vmware vrealize_operations VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user. | 0.4% | — |