59.344 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.344 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più basso |
|---|---|---|---|---|
| CVE-2026-81381 | MED 6.5 | microsoft visual_studio_code Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 0,9% | — |
| CVE-2026-81380 | MED 5.3 | microsoft visual_studio_code Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 0,6% | — |
| CVE-2026-81379 | HIGH 8.2 | microsoft visual_studio_code Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 0,5% | — |
| CVE-2026-81378 | HIGH 8.2 | microsoft visual_studio_code Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 0,5% | — |
| CVE-2026-81377 | MED 6.5 | microsoft visual_studio_code Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | 0,8% | — |
| CVE-2026-81376 | CRIT 9.6 | microsoft visual_studio_code Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 0,8% | — |
| CVE-2026-81357 | HIGH 8.2 | microsoft visual_studio_code Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 0,5% | — |
| CVE-2026-81356 | HIGH 8.2 | microsoft visual_studio_code Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 0,5% | — |
| CVE-2026-81355 | HIGH 7.5 | microsoft windows_10_1607 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. | 0,2% | — |
| CVE-2026-81354 | HIGH 8.2 | microsoft windows_10_1809 Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-81353 | HIGH 7.8 | microsoft heif_image_extension Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. | 0,5% | — |
| CVE-2026-81352 | HIGH 8.8 | microsoft web_media_extensions Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | 0,5% | — |
| CVE-2026-81349 | HIGH 7.2 | microsoft azure_hdinsight Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network. | 1,0% | — |
| CVE-2026-81326 | MED 5.5 | QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password. | 0,1% | — |
| CVE-2026-80725 | CRIT 9.8 | In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and pla | 0,5% | — |
| CVE-2026-80724 | HIGH 8.8 | In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. User | 0,2% | — |
| CVE-2026-80689 | ND | In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() a | 0,2% | — |
| CVE-2026-80685 | HIGH 7.1 | In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an or | 0,2% | — |
| CVE-2026-80671 | CRIT 9.3 | In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc * | 0,2% | — |
| CVE-2026-8056 | HIGH 8.8 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function. | 0,5% | — |
| CVE-2026-80530 | HIGH 7.1 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file tha | 0,1% | — |
| CVE-2026-80521 | HIGH 7.8 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^ | 0,2% | — |
| CVE-2026-8036 | HIGH 7.1 | ni ni-pal Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux. | 0,2% | — |
| CVE-2026-80354 | HIGH 8.1 | apache camel Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to | 0,5% | — |
| CVE-2026-80352 | CRIT 9.8 | apache camel Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthoriz | 0,8% | — |