59.497 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.497 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-84009 | MED 4.7 | microsoft windows_10_1809 Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally. | 0.2% | — |
| CVE-2026-83897 | MED 4.7 | microsoft windows_10_1607 Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83865 | MED 4.7 | microsoft windows_10_1607 Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-83774 | MED 4.7 | microsoft windows_10_1607 Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-72931 | MED 4.7 | microsoft windows_10_1607 Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally. | 0.3% | — |
| CVE-2026-69895 | MED 4.7 | microsoft windows_10_1607 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-69853 | MED 4.7 | microsoft windows_10_1607 Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-69792 | MED 4.7 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to bypass a security feature locally. | 0.2% | — |
| CVE-2026-69771 | MED 4.7 | microsoft windows_11_23h2 Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-69483 | MED 4.7 | microsoft windows_10_1607 Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-69425 | MED 4.7 | microsoft windows_11_23h2 Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-69316 | MED 4.7 | microsoft windows_10_1607 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-68891 | MED 4.7 | microsoft windows_10_1607 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-68849 | MED 4.7 | microsoft windows_10_21h2 Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-64373 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, t | 0.1% | — |
| CVE-2026-64282 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier In the case that kvm_translate_vncr() races with an MMU notifier the early return does not release a reference on the | 0.1% | — |
| CVE-2026-64043 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ovpn: fix race between deleting interface and adding new peer While deleting an existing ovpn interface, there is a very narrow window where adding a new peer via netlink may cause the netde | 0.1% | — |
| CVE-2026-64038 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_in | 0.1% | — |
| CVE-2026-57031 | MED 4.7 | juniper junos An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters. On MX Series devices with MPC10/11, LC4800 | 0.2% | — |
| CVE-2026-53352 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL | 0.1% | — |
| CVE-2026-53108 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP p | 0.1% | — |
| CVE-2026-53008 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ice: fix race condition in TX timestamp ring cleanup Fix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map() that can cause a NULL pointer dereference. ice_free_tx_tstamp_ri | 0.1% | — |
| CVE-2026-50657 | MED 4.7 | microsoft defender_for_endpoint Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50312 | MED 4.7 | microsoft windows_10_1607 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-50310 | MED 4.7 | microsoft windows_10_1809 Integer overflow or wraparound in Windows Devices Human Interface allows an authorized attacker to disclose information locally. | 0.3% | — |