60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-63876 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA f | 0.2% | — |
| CVE-2026-63873 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() aie2_populate_range() jumps back to the again label without calling mmput(mm), leaking a reference to the mm_struct. Add | 0.2% | — |
| CVE-2026-63868 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeof(*ga) - ga->len; ga->len | 0.1% | — |
| CVE-2026-63862 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the fun | 0.1% | — |
| CVE-2026-63861 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remov | 0.1% | — |
| CVE-2026-63859 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in airoha_qdma_cleanup_tx_queue routine. Moreover, reset T | 0.1% | — |
| CVE-2026-63798 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe and sets up cha | 0.1% | — |
| CVE-2026-63531 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-63530 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-63529 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-63528 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-63524 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-63521 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-63517 | MED 5.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-62887 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62879 | MED 5.5 | microsoft windows_10_1809 Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-62798 | MED 5.5 | microsoft windows_11_23h2 Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62796 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62793 | MED 5.5 | microsoft windows_10_1607 Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62786 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62775 | MED 5.5 | microsoft windows_11_26h1 Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62746 | MED 5.5 | microsoft windows_10_1607 Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62743 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62740 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-62738 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | 0.4% | — |