59.497 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.497 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più basso |
|---|---|---|---|---|
| CVE-2026-69270 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-69269 | HIGH 7.8 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-69268 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-69267 | MED 6.5 | microsoft windows_10_1809 Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally. | 0,4% | — |
| CVE-2026-69266 | HIGH 8.8 | microsoft windows_10_1607 Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-69265 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-6925 | MED 5.3 | ibm concert IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system. | 0,3% | — |
| CVE-2026-69223 | CRIT 9.1 | apache allura Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. | 0,8% | — |
| CVE-2026-69220 | ND | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call Val | 0,7% | — |
| CVE-2026-69219 | ND | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength | 0,7% | — |
| CVE-2026-6921 | HIGH 8.3 | google chrome Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium) | 0,2% | — |
| CVE-2026-6920 | CRIT 9.6 | google chrome Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-6919 | CRIT 9.6 | google chrome Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-68981 | HIGH 7.5 | apache nifi Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing | 0,7% | — |
| CVE-2026-68980 | CRIT 9.1 | apache nifi Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifie | 0,5% | — |
| CVE-2026-68979 | CRIT 9.8 | apache nifi Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing compo | 0,8% | — |
| CVE-2026-68971 | MED 6.5 | apache airflow Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manag | 0,3% | — |
| CVE-2026-68970 | MED 6.5 | apache airflow Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string | 0,2% | — |
| CVE-2026-68969 | MED 6.5 | apache airflow Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level | 0,4% | — |
| CVE-2026-68968 | HIGH 7.5 | apache airflow Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegative | 0,4% | — |
| CVE-2026-68898 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network. | 0,9% | — |
| CVE-2026-68897 | HIGH 7.0 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-68896 | HIGH 7.8 | microsoft windows_11_23h2 Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2026-68895 | MED 5.5 | microsoft windows_10_1607 Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally. | 0,4% | — |
| CVE-2026-68894 | HIGH 8.0 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | 0,8% | — |