59.646 CVE seguite
805 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.646 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-54399 | HIGH 7.5 | apache httpcomponents_core Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with ex | 0,8% | — |
| CVE-2026-54225 | HIGH 7.5 | apache cxf Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly | 0,7% | — |
| CVE-2026-54183 | MED 4.3 | apache airflow Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holdin | 0,4% | — |
| CVE-2026-54132 | MED 6.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. | 0,4% | — |
| CVE-2026-54131 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0,5% | — |
| CVE-2026-54130 | CRIT 9.8 | microsoft 365_copilot Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 1,1% | — |
| CVE-2026-54129 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-54128 | HIGH 8.4 | microsoft windows_10_1607 Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally. | 0,4% | — |
| CVE-2026-54127 | HIGH 7.4 | microsoft windows_11_24h2 Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-54126 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 0,9% | — |
| CVE-2026-54125 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-54124 | HIGH 7.8 | microsoft terminal Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally. | 0,5% | — |
| CVE-2026-54123 | MED 5.5 | microsoft defender_for_endpoint Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally. | 0,5% | — |
| CVE-2026-54122 | HIGH 8.4 | microsoft windows_10_1607 Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. | 0,4% | — |
| CVE-2026-54121 | HIGH 8.8 | microsoft windows_10_1607 Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | 0,8% | — |
| CVE-2026-54120 | CRIT 9.9 | microsoft surface_management_services Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. | 1,0% | — |
| CVE-2026-54119 | HIGH 7.5 | microsoft windows_10_1607 Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network. | 1,2% | — |
| CVE-2026-54118 | CRIT 9.8 | microsoft sql_server_2016 Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 1,5% | — |
| CVE-2026-54117 | CRIT 9.8 | microsoft sql_server_2016 Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 1,5% | — |
| CVE-2026-54116 | MED 6.5 | microsoft sql_server_2025 Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. | 1,0% | — |
| CVE-2026-54115 | HIGH 7.8 | microsoft windows_10_1607 Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-54114 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-54113 | HIGH 7.5 | microsoft windows_10_1607 Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | 1,2% | — |
| CVE-2026-54112 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0,2% | — |
| CVE-2026-54111 | HIGH 7.0 | microsoft windows_11_24h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | 0,2% | — |